Analysis
- max time kernel
140s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
31/08/2022, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe
- Size 2.1MB
- Sample220831-ddx3asfhap
- SHA256 90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c
- MD5 e4311ab08f705b3b150e1be181c9e260
- SHA1 3c8cdf195e5d2ff97524c60edbcf7c1f4c58a87f
- SHA512 26ba5e2d8cf92aa5f4cf80021fe5d798ef92b529d4139d9b85de2d0cecdf3966257d9832466e7d08cb5f5d6494b465ef3988b4b444df4377f0723975cc62cb52
- SSDEEP 49152:smV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:smDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe - Executes dropped EXE 1 IoCs
pid Process 3524 svchost.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b045f9a7 = "EݲI\x17ª\x13ÍËÑ>ÛúïD\vZ\f\x0eJýÿ\x15\x01¦…¶A©É½\"b2š÷B^$ç~\x02ÊZ–fâÖÞü(¾¶ f\x0f!„öÆ™¬\u007föñž€n&¹\x1aæaú¾66¡š¦x\n©®Âñú\x12nJ" HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b045f9a7 = "EݲI\x17ª\x13ÍËÑ>ÛúïD\vZ\f\x0eJýÿ\x15\x01¦…¶A©É½\"b2š÷B^$ç~\x02ÊZ–fâÖÞü(¾¶ f\x0f!„öÆ™¬\u007föñž€n&¹\x1aæaú¾66¡š¦x\n©®Âñú\x12nJ" svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\apppatch\svchost.exe HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe File created C:\Windows\apppatch\svchost.exe HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe 3524 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4452 wrote to memory of 3524 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 82 PID 4452 wrote to memory of 3524 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 82 PID 4452 wrote to memory of 3524 4452 HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-90a23ff30cf40dbf180e2ca98360bbcecaf1a736f7bb118efe7fbff2db7dc82c.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\apppatch\svchost.exe
- Size 2.1MB
- SHA256 9f818afb9bf9cb25daa7a4a21b4a117d5f3337cec22fb69a02eb22505a47ab72
- MD5 146dac3c34bba135ca54db0c658b4ddd
- SHA1 c5252036f4bbee7dedca64a47bc67c4a63a0c59c
- SHA512 2143cefc5ebeee7a783885e9646c341fa2344dad145a44775ebb840719840428dd2e08150aa64d0029438bc735058face334abbd3aeab7d9d14773b15aa95168
- SSDEEP 49152:rmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:rmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\apppatch\svchost.exe
- Size 2.1MB
- SHA256 9f818afb9bf9cb25daa7a4a21b4a117d5f3337cec22fb69a02eb22505a47ab72
- MD5 146dac3c34bba135ca54db0c658b4ddd
- SHA1 c5252036f4bbee7dedca64a47bc67c4a63a0c59c
- SHA512 2143cefc5ebeee7a783885e9646c341fa2344dad145a44775ebb840719840428dd2e08150aa64d0029438bc735058face334abbd3aeab7d9d14773b15aa95168
- SSDEEP 49152:rmV2ApPmV2ApPmV2Ap/mV2ApPmV2ApPmV2Ap8:rmDmDm7mDmDmQ
- MD5 SHA1 SHA512 SSDEEP