Analysis
-
max time kernel
160s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 07:02
Static task
static1
Behavioral task
behavioral1
Sample
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
-
Size
905KB
-
MD5
aaee5f473ed1f17be96f642f9e4058bc
-
SHA1
6a59a9dc5e92e9cfeb5e93f71410fe2a146640a8
-
SHA256
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723
-
SHA512
6902e5b160dea23257eca5fa10e407fc436a3f181922c76023d09803c55efa74e77484a39f2e083da716616da35f85ed2090073867eba53bcbe53e2bfcab1da7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3444-130-0x0000000000030000-0x0000000000221000-memory.dmp upx behavioral2/memory/3444-131-0x0000000000030000-0x0000000000221000-memory.dmp upx behavioral2/memory/3444-138-0x0000000000030000-0x0000000000221000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMEWDBLD.url 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3444-138-0x0000000000030000-0x0000000000221000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exedescription pid Process procid_target PID 3444 set thread context of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid Process 1796 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegAsm.exedescription pid Process Token: SeDebugPrivilege 1796 RegAsm.exe Token: 33 1796 RegAsm.exe Token: SeIncBasePriorityPrivilege 1796 RegAsm.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exepid Process 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exepid Process 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid Process 1796 RegAsm.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exedescription pid Process procid_target PID 3444 wrote to memory of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83 PID 3444 wrote to memory of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83 PID 3444 wrote to memory of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83 PID 3444 wrote to memory of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83 PID 3444 wrote to memory of 1796 3444 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe"C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3904