6286a34f6c9835d44ef8dc06ae1f56bf8b9735abe78b38b06ba5be366a6164e1

Analysis

max time kernel
117s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Zusy.435740.7544.exe
Size 215KB
Sample220817-prrm8aaee8
SHA256 6286a34f6c9835d44ef8dc06ae1f56bf8b9735abe78b38b06ba5be366a6164e1
MD5 a257097c887574a9a1debae1da6a7700
SHA1 586d283b9aa5f83a71482930d9cddb6bdda07018
SHA512 639fed5ac948e3bd2c1b2533b17c4bb22c7b347fc606b4da4238d4523b34b7cac3f11b7f8b44b8e3aa53d9b615cf4b9bf2ebaec96ffb55cce0a409117fb377c2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3748	da8b1a46.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.amazonaws.com
5	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4036	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81
PID 888 wrote to memory of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81
PID 888 wrote to memory of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81
PID 888 wrote to memory of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81
PID 888 wrote to memory of 5028	888	SecuriteInfo.com.Variant.Zusy.435740.7544.exe	81
PID 5028 wrote to memory of 4640	5028	AppLaunch.exe	82
PID 5028 wrote to memory of 4640	5028	AppLaunch.exe	82
PID 5028 wrote to memory of 4640	5028	AppLaunch.exe	82
PID 4640 wrote to memory of 2232	4640	cmd.exe	84
PID 4640 wrote to memory of 2232	4640	cmd.exe	84
PID 4640 wrote to memory of 2232	4640	cmd.exe	84
PID 4640 wrote to memory of 4036	4640	cmd.exe	85
PID 4640 wrote to memory of 4036	4640	cmd.exe	85
PID 4640 wrote to memory of 4036	4640	cmd.exe	85
PID 4640 wrote to memory of 3748	4640	cmd.exe	86
PID 4640 wrote to memory of 3748	4640	cmd.exe	86
PID 4640 wrote to memory of 3748	4640	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.7544.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.7544.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8215.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d "C:\ProgramData\Keyboard Win v4.8.3"
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      Delays execution with timeout.exe
      PID:4036
  - - C:\ProgramData\Keyboard Win v4.8.3\da8b1a46.exe
      "C:\ProgramData\Keyboard Win v4.8.3\da8b1a46.exe"
      4⤵
      Executes dropped EXE
      PID:3748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

da8b1a46.exe

Path C:\ProgramData\Keyboard Win v4.8.3\da8b1a46.exe
Size 779KB
SHA256 0ad139c73f8946ba0213db8f047fc0d10a8f37d5e13c1e020fa5ca01d40ac8ec
MD5 79b0c7c414f8637358b1f4827b3a88c0
SHA1 5b68000cea155d89785db8fcf97cab345bfd080d
SHA512 a86eb789cc1f2688dca6ed603e5feb8ebacb8cdbbd9d37760ef699ba9df505945f61c1a75f475d741a3135c84bcb27ab47aa9132ade29ca982b722e326f773d2
SSDEEP 12288:HnudwxC2sOdmZ6v/DqF5hXWB10f0JXuMFyrkuiy6oSa2IQeFEvVMlWhwkr4xBW0w:HnudwxC2sL6OF5hGpJ+M4rMhiEeQ4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

da8b1a46.exe

Path C:\ProgramData\Keyboard Win v4.8.3\da8b1a46.exe
Size 779KB
SHA256 0ad139c73f8946ba0213db8f047fc0d10a8f37d5e13c1e020fa5ca01d40ac8ec
MD5 79b0c7c414f8637358b1f4827b3a88c0
SHA1 5b68000cea155d89785db8fcf97cab345bfd080d
SHA512 a86eb789cc1f2688dca6ed603e5feb8ebacb8cdbbd9d37760ef699ba9df505945f61c1a75f475d741a3135c84bcb27ab47aa9132ade29ca982b722e326f773d2
SSDEEP 12288:HnudwxC2sOdmZ6v/DqF5hXWB10f0JXuMFyrkuiy6oSa2IQeFEvVMlWhwkr4xBW0w:HnudwxC2sL6OF5hGpJ+M4rMhiEeQ4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp8215.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8215.tmp.bat
Size 340B
SHA256 7e6d42aef2ae6c7e7748431b1c8ef47504af2fe501d56684558c63c51ab3c236
MD5 18fcd9a3b8a2aed732fee989ec2f9751
SHA1 aee4606826501e9271e300cd5eb14255d446e6a0
SHA512 ecbbbc0641cefff36d55965e689ca62c69c94d02781822a3890a9bb6d881862b4cdfd31e67e5ebe5b5866ed336b4d1563ce88b8f7a46af3a4e8bffd5ec15eddf
MD5 SHA1 SHA512

Submit Download

memory/5028-133-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5028-138-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads