Analysis
-
max time kernel
151s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 16:18
Static task
static1
Behavioral task
behavioral1
Sample
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Resource
win10v2004-20220414-en
General
-
Target
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
-
Size
423KB
-
MD5
465684a387882a2967ab06480bbd5e41
-
SHA1
ca5de6208c51538cfd9658db7831194fc4ee928a
-
SHA256
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0
-
SHA512
bab8fa9a91a88ea7bdd814d2b0046586c7d4b845d750af00b50b147db3b25ba4fabc3bacc2f78b1cd361c45ed585f0cd69d7c3ac7a9b21bfa4ecbbcc42d4b088
Malware Config
Signatures
-
suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\WINSXS32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe" 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exedescription pid process target process PID 1776 set thread context of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 set thread context of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 set thread context of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exepid process 2008 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exedescription pid process target process PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 2008 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1224 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe PID 1776 wrote to memory of 1628 1776 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exeNdxUsil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exeNdxUsil.exe2⤵
- Adds Run key to start application
PID:1224
-
-
C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exebitcoin-miner.exe -a 60 -l no -o http://kdusd.cantvenlinea.biz:1942/ -u zephyr.oioioioioioioioi -p Nu7788002⤵PID:1628
-