Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 07:37
Static task
static1
Behavioral task
behavioral1
Sample
a57c8822899013c8d0bbd87b4c36821a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a57c8822899013c8d0bbd87b4c36821a.exe
-
Size
341KB
-
MD5
a57c8822899013c8d0bbd87b4c36821a
-
SHA1
54da561ef6e0d2c368aca185ee828d67543fbf9e
-
SHA256
ddb95e81345469771c505272274d21eb2e317ed8c46e0b679362df7cbf52ba6c
-
SHA512
e070796a826d125787f875a587ada069799507f6fe842f05c5963d9080ee255b5a2d7097f996cfb19f9b08120beb6b47f722e17d3818ee09accdc5ae3354d247
Malware Config
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral1/memory/1964-55-0x0000000000D40000-0x0000000000D92000-memory.dmp beds_protector -
HiveRAT Payload 15 IoCs
resource yara_rule behavioral1/memory/1120-60-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-61-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-63-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-62-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-64-0x000000000044C7DE-mapping.dmp family_hiverat behavioral1/memory/1120-66-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-68-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-70-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-71-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-72-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-73-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-77-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-80-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-81-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/1120-82-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a57c8822899013c8d0bbd87b4c36821a.exe a57c8822899013c8d0bbd87b4c36821a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a57c8822899013c8d0bbd87b4c36821a.exe a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe 1964 a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 a57c8822899013c8d0bbd87b4c36821a.exe Token: SeDebugPrivilege 1120 a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27 PID 1964 wrote to memory of 1120 1964 a57c8822899013c8d0bbd87b4c36821a.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120
-