dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-06-2022 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73.exe
Size

196KB
MD5

113ac743212e56ac38d22182d7b38385
SHA1

f1098d33d3fe81e370ea1d75096f51d3bebcd855
SHA256

dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e
SHA512

ea3f71ea5a135c96a8b768ad4c1f5405892c28ec148981608de2433fdaca3bd80b2c90af5a39c9e67603829fabd1c60b11023511cc56f1d2d0106c747788c320

Score

10^/10

persistence suricata upx

Malware Config

Signatures

suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4504-135-0x0000000004000000-0x0000000004218000-memory.dmp	upx
behavioral2/memory/3832-140-0x0000000004000000-0x000000000408E000-memory.dmp	upx
behavioral2/memory/3184-142-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/3184-145-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/3184-148-0x0000000004000000-0x0000000004215000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 192.228.79.201
Destination IP 128.8.10.90
Destination IP 202.12.27.33
Destination IP 192.5.5.241

description	ioc
Destination IP	192.228.79.201
Destination IP	128.8.10.90
Destination IP	202.12.27.33
Destination IP	192.5.5.241

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exesvchost.exe73.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tibqanobatib = "C:\\Users\\Admin\\tibqanobatib.exe"	73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

73.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1876 set thread context of 4504	1876	73.exe	svchost.exe
PID 1876 set thread context of 3832	1876	73.exe	svchost.exe
PID 4504 set thread context of 5080	4504	svchost.exe	svchost.exe
PID 1876 set thread context of 3184	1876	73.exe	svchost.exe
PID 4504 set thread context of 4576	4504	svchost.exe	svchost.exe
PID 3184 set thread context of 4092	3184	svchost.exe	svchost.exe
PID 4504 set thread context of 2296	4504	svchost.exe	svchost.exe
PID 3184 set thread context of 684	3184	svchost.exe	svchost.exe
PID 4504 set thread context of 3452	4504	svchost.exe	svchost.exe
PID 3184 set thread context of 1676	3184	svchost.exe	svchost.exe
PID 3184 set thread context of 1736	3184	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

73.exe

pid process

1876 73.exe
1876 73.exe

pid	process
1876	73.exe
1876	73.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

73.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1876 wrote to memory of 4504	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 4504	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 4504	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 4504	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 4504	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3832	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3832	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3832	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3832	1876	73.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 1876 wrote to memory of 3832	1876	73.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 1876 wrote to memory of 3184	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3184	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3184	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3184	1876	73.exe	svchost.exe
PID 1876 wrote to memory of 3184	1876	73.exe	svchost.exe
PID 4504 wrote to memory of 5080	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 4504 wrote to memory of 4576	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 3184 wrote to memory of 4092	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 4504 wrote to memory of 2296	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 3184 wrote to memory of 684	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 4504 wrote to memory of 3452	4504	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1676	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe
PID 3184 wrote to memory of 1736	3184	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\73.exe
"C:\Users\Admin\AppData\Local\Temp\73.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:5080

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2296

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3452

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:3832

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:4092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:684

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:1676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-192-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/684-159-0x0000000000000000-mapping.dmp

Download
memory/684-166-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/684-173-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/684-160-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/684-182-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1676-176-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1676-199-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1676-169-0x0000000000000000-mapping.dmp

Download
memory/1676-172-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1676-187-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/1676-186-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1676-181-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1736-183-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1736-180-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1736-194-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1736-178-0x0000000000000000-mapping.dmp

Download
memory/1736-195-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/1736-185-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1876-130-0x0000000000661000-0x000000000066C000-memory.dmp

Filesize
44KB

Download
memory/1876-189-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/1876-132-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/1876-188-0x0000000000661000-0x000000000066C000-memory.dmp

Filesize
44KB

Download
memory/1876-131-0x0000000000590000-0x00000000005A3000-memory.dmp

Filesize
76KB

Download
memory/2296-161-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2296-167-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2296-179-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/2296-191-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2296-156-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2296-155-0x0000000000000000-mapping.dmp

Download
memory/3184-141-0x0000000000000000-mapping.dmp

Download
memory/3184-148-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3184-142-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3184-145-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3452-163-0x0000000000000000-mapping.dmp

Download
memory/3452-165-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3452-171-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3452-184-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3452-193-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3452-198-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3452-175-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3832-136-0x0000000000000000-mapping.dmp

Download
memory/3832-137-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3832-140-0x0000000004000000-0x000000000408E000-memory.dmp

Filesize
568KB

Download
memory/3832-152-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4092-153-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4092-151-0x0000000000000000-mapping.dmp

Download
memory/4092-177-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4092-174-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4092-162-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4092-197-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4092-157-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4504-149-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4504-135-0x0000000004000000-0x0000000004218000-memory.dmp

Filesize
2.1MB

Download
memory/4504-134-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4504-133-0x0000000000000000-mapping.dmp

Download
memory/4576-154-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4576-190-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4576-147-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4576-170-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4576-146-0x0000000000000000-mapping.dmp

Download
memory/4576-158-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/5080-139-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/5080-138-0x0000000000000000-mapping.dmp

Download
memory/5080-143-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/5080-150-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/5080-168-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/5080-196-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/5080-164-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download