Analysis
- max time kernel
148s - max time network
152s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
31/08/2022, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
- Size 2.1MB
- Sample220831-ddx3asfhap
- SHA256 90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c
- MD5 e4311ab08f705b3b150e1be181c9e260
- SHA1 3c8cdf195e5d2ff97524c60edbcf7c1f4c58a87f
- SHA512 26ba5e2d8cf92aa5f4cf80021fe5d798ef92b529d4139d9b85de2d0cecdf3966257d9832466e7d08cb5f5d6494b465ef3988b4b444df4377f0723975cc62cb52
- SSDEEP 49152:smV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:smDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe - Executes dropped EXE 1 IoCs
pid Process 1948 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\d6454201 = "L\u009d¤q." HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\d6454201 = "L\u009d¤q." svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\apppatch\svchost.exe HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe File created C:\Windows\apppatch\svchost.exe HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe 1948 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 832 wrote to memory of 1948 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 27 PID 832 wrote to memory of 1948 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 27 PID 832 wrote to memory of 1948 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 27 PID 832 wrote to memory of 1948 832 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\AppPatch\svchost.exe
- Size 2.1MB
- SHA256 0697ff536eecd831582272a661a12b413f1158ebf0d93d8ab88b1c542ade0aa7
- MD5 6aa9b9d653f481f6bc02912131b4e589
- SHA1 ac93fa1d9efa6297dc0b4d6092c049f1d17556f9
- SHA512 265001ae4a58dc7a585e7f8a27905d457368a96f84462e3b7971a6592ae6734a9cfbaaa0c051559596ea463d92f78b6a99b36a555a5442493d7ebb5250e156a7
- SSDEEP 49152:XmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:XmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\apppatch\svchost.exe
- Size 2.1MB
- SHA256 0697ff536eecd831582272a661a12b413f1158ebf0d93d8ab88b1c542ade0aa7
- MD5 6aa9b9d653f481f6bc02912131b4e589
- SHA1 ac93fa1d9efa6297dc0b4d6092c049f1d17556f9
- SHA512 265001ae4a58dc7a585e7f8a27905d457368a96f84462e3b7971a6592ae6734a9cfbaaa0c051559596ea463d92f78b6a99b36a555a5442493d7ebb5250e156a7
- SSDEEP 49152:XmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:XmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\AppPatch\svchost.exe
- Size 2.1MB
- SHA256 0697ff536eecd831582272a661a12b413f1158ebf0d93d8ab88b1c542ade0aa7
- MD5 6aa9b9d653f481f6bc02912131b4e589
- SHA1 ac93fa1d9efa6297dc0b4d6092c049f1d17556f9
- SHA512 265001ae4a58dc7a585e7f8a27905d457368a96f84462e3b7971a6592ae6734a9cfbaaa0c051559596ea463d92f78b6a99b36a555a5442493d7ebb5250e156a7
- SSDEEP 49152:XmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:XmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\AppPatch\svchost.exe
- Size 2.1MB
- SHA256 0697ff536eecd831582272a661a12b413f1158ebf0d93d8ab88b1c542ade0aa7
- MD5 6aa9b9d653f481f6bc02912131b4e589
- SHA1 ac93fa1d9efa6297dc0b4d6092c049f1d17556f9
- SHA512 265001ae4a58dc7a585e7f8a27905d457368a96f84462e3b7971a6592ae6734a9cfbaaa0c051559596ea463d92f78b6a99b36a555a5442493d7ebb5250e156a7
- SSDEEP 49152:XmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:XmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP