1612c1e0be2ca02cfce80bf05a8894685398f073cf88336ef6d4fd09fc0dedef

Analysis

max time kernel
61s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Lazy.234899.25717.exe
Size 227KB
Sample220817-mpdbpsedbj
SHA256 1612c1e0be2ca02cfce80bf05a8894685398f073cf88336ef6d4fd09fc0dedef
MD5 fe02f0ff20e7352a93bc6e0a572a9b24
SHA1 f4403d5721878ab06c76adea3a691512baa846e9
SHA512 32bc48e7640c042443d07dd12406d503f35e3c545222cfeb03e87458e5ed1aaf1a61e6af60dc81409af5c4d279a0f380e6e963a94e090a914eeaa2962fa085d1
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3796	e402ff42.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	checkip.amazonaws.com
9	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4240	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84
PID 4904 wrote to memory of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84
PID 4904 wrote to memory of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84
PID 4904 wrote to memory of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84
PID 4904 wrote to memory of 4732	4904	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	84
PID 4732 wrote to memory of 2980	4732	RegSvcs.exe	85
PID 4732 wrote to memory of 2980	4732	RegSvcs.exe	85
PID 4732 wrote to memory of 2980	4732	RegSvcs.exe	85
PID 2980 wrote to memory of 228	2980	cmd.exe	87
PID 2980 wrote to memory of 228	2980	cmd.exe	87
PID 2980 wrote to memory of 228	2980	cmd.exe	87
PID 2980 wrote to memory of 4240	2980	cmd.exe	88
PID 2980 wrote to memory of 4240	2980	cmd.exe	88
PID 2980 wrote to memory of 4240	2980	cmd.exe	88
PID 2980 wrote to memory of 3796	2980	cmd.exe	89
PID 2980 wrote to memory of 3796	2980	cmd.exe	89
PID 2980 wrote to memory of 3796	2980	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.25717.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.25717.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFDE.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d "C:\ProgramData\Microsoft Layout v9.4.9"
      4⤵
      PID:228
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      Delays execution with timeout.exe
      PID:4240
  - - C:\ProgramData\Microsoft Layout v9.4.9\e402ff42.exe
      "C:\ProgramData\Microsoft Layout v9.4.9\e402ff42.exe"
      4⤵
      Executes dropped EXE
      PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

e402ff42.exe

Path C:\ProgramData\Microsoft Layout v9.4.9\e402ff42.exe
Size 11.7MB
SHA256 752ff05748377245c4cbbc02e494e7c70f224c3ff32ec937b03f702c8d3baa26
MD5 ee367843ac3f66e0bf41f61953ff6e5d
SHA1 68cf78c9fab4bf908cdcc12f4bb8c446c5a5dba5
SHA512 c813808f27e244264f7625198dd70f54cbdf1a1919808a267def29c6ef36d0c8587be442c9389156b3071c0388bb55f6d3eb0d6b09e8d8d073fb85052936d126
SSDEEP 196608:QLp32oFOcbO3ivyH1f6o+vEozLajo/ZnGyvZpdmIW8kQbUk/dZNm/UOLclXE87wj:QLpmM63ivyVcbzLv/ZnGKpvWjQbUkscU
MD5 SHA1 SHA512 SSDEEP

Submit Download

e402ff42.exe

Path C:\ProgramData\Microsoft Layout v9.4.9\e402ff42.exe
Size 11.7MB
SHA256 752ff05748377245c4cbbc02e494e7c70f224c3ff32ec937b03f702c8d3baa26
MD5 ee367843ac3f66e0bf41f61953ff6e5d
SHA1 68cf78c9fab4bf908cdcc12f4bb8c446c5a5dba5
SHA512 c813808f27e244264f7625198dd70f54cbdf1a1919808a267def29c6ef36d0c8587be442c9389156b3071c0388bb55f6d3eb0d6b09e8d8d073fb85052936d126
SSDEEP 196608:QLp32oFOcbO3ivyH1f6o+vEozLajo/ZnGyvZpdmIW8kQbUk/dZNm/UOLclXE87wj:QLpmM63ivyVcbzLv/ZnGKpvWjQbUkscU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpFDE.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpFDE.tmp.bat
Size 347B
SHA256 b92676928a0e7644d6617af7e8d8bb6e48da3d5414fefb1b9af1ca7453136af1
MD5 9dfe94e779c5276e78eb98afc0df02a8
SHA1 118b67127dd4fc2eb91e41399a05da5354f57041
SHA512 1d6a542299100be43beff96199cf5b9bec5337319192dab47c251aba582aa9c1c8a8a4f3028d49d0654619dd17da4422f8982852c164bc189cc0c54dfeaeac58
MD5 SHA1 SHA512

Submit Download

memory/3796-146-0x0000000000E60000-0x0000000000E6E000-memory.dmp

Download

memory/3796-147-0x0000000005600000-0x000000000563C000-memory.dmp

Download

memory/4732-133-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4732-138-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads