Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
17/09/2022, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe
Resource
win10-20220901-en
General
-
Target
19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe
-
Size
719KB
-
MD5
98d2184f4e2245b62d7409a3a7cbab41
-
SHA1
682a129d5151d6a80772a2cf29ecc1e649c968c1
-
SHA256
19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250
-
SHA512
58e4121b758af949235516bb4d5b3ead8f49654941d7fc3db6341a3175ff4f58f199c1ff68ee9200b5c98ad1ddbf1a7886dfcb86643598c884d604846427d625
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4300 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3836 schtasks.exe 4636 schtasks.exe 4944 schtasks.exe 4736 schtasks.exe 3564 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1560 powershell.exe 1560 powershell.exe 1560 powershell.exe 3040 powershell.exe 3040 powershell.exe 3040 powershell.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe 4300 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1560 powershell.exe Token: SeDebugPrivilege 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeDebugPrivilege 4300 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 1412 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 66 PID 3316 wrote to memory of 1412 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 66 PID 3316 wrote to memory of 1412 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 66 PID 1412 wrote to memory of 3580 1412 cmd.exe 68 PID 1412 wrote to memory of 3580 1412 cmd.exe 68 PID 1412 wrote to memory of 3580 1412 cmd.exe 68 PID 1412 wrote to memory of 1560 1412 cmd.exe 69 PID 1412 wrote to memory of 1560 1412 cmd.exe 69 PID 1412 wrote to memory of 1560 1412 cmd.exe 69 PID 1412 wrote to memory of 3040 1412 cmd.exe 70 PID 1412 wrote to memory of 3040 1412 cmd.exe 70 PID 1412 wrote to memory of 3040 1412 cmd.exe 70 PID 3316 wrote to memory of 4300 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 71 PID 3316 wrote to memory of 4300 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 71 PID 3316 wrote to memory of 4300 3316 19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe 71 PID 4300 wrote to memory of 1432 4300 dllhost.exe 72 PID 4300 wrote to memory of 1432 4300 dllhost.exe 72 PID 4300 wrote to memory of 1432 4300 dllhost.exe 72 PID 4300 wrote to memory of 368 4300 dllhost.exe 73 PID 4300 wrote to memory of 368 4300 dllhost.exe 73 PID 4300 wrote to memory of 368 4300 dllhost.exe 73 PID 4300 wrote to memory of 4696 4300 dllhost.exe 74 PID 4300 wrote to memory of 4696 4300 dllhost.exe 74 PID 4300 wrote to memory of 4696 4300 dllhost.exe 74 PID 4300 wrote to memory of 4432 4300 dllhost.exe 75 PID 4300 wrote to memory of 4432 4300 dllhost.exe 75 PID 4300 wrote to memory of 4432 4300 dllhost.exe 75 PID 4300 wrote to memory of 4492 4300 dllhost.exe 76 PID 4300 wrote to memory of 4492 4300 dllhost.exe 76 PID 4300 wrote to memory of 4492 4300 dllhost.exe 76 PID 4300 wrote to memory of 660 4300 dllhost.exe 77 PID 4300 wrote to memory of 660 4300 dllhost.exe 77 PID 4300 wrote to memory of 660 4300 dllhost.exe 77 PID 4300 wrote to memory of 4896 4300 dllhost.exe 94 PID 4300 wrote to memory of 4896 4300 dllhost.exe 94 PID 4300 wrote to memory of 4896 4300 dllhost.exe 94 PID 4300 wrote to memory of 1908 4300 dllhost.exe 93 PID 4300 wrote to memory of 1908 4300 dllhost.exe 93 PID 4300 wrote to memory of 1908 4300 dllhost.exe 93 PID 4300 wrote to memory of 1324 4300 dllhost.exe 80 PID 4300 wrote to memory of 1324 4300 dllhost.exe 80 PID 4300 wrote to memory of 1324 4300 dllhost.exe 80 PID 4300 wrote to memory of 2192 4300 dllhost.exe 92 PID 4300 wrote to memory of 2192 4300 dllhost.exe 92 PID 4300 wrote to memory of 2192 4300 dllhost.exe 92 PID 4300 wrote to memory of 328 4300 dllhost.exe 91 PID 4300 wrote to memory of 328 4300 dllhost.exe 91 PID 4300 wrote to memory of 328 4300 dllhost.exe 91 PID 4300 wrote to memory of 3292 4300 dllhost.exe 84 PID 4300 wrote to memory of 3292 4300 dllhost.exe 84 PID 4300 wrote to memory of 3292 4300 dllhost.exe 84 PID 1432 wrote to memory of 3836 1432 cmd.exe 96 PID 1432 wrote to memory of 3836 1432 cmd.exe 96 PID 1432 wrote to memory of 3836 1432 cmd.exe 96 PID 660 wrote to memory of 4636 660 cmd.exe 97 PID 660 wrote to memory of 4636 660 cmd.exe 97 PID 660 wrote to memory of 4636 660 cmd.exe 97 PID 4432 wrote to memory of 4736 4432 cmd.exe 99 PID 4432 wrote to memory of 4736 4432 cmd.exe 99 PID 4432 wrote to memory of 4736 4432 cmd.exe 99 PID 368 wrote to memory of 4944 368 cmd.exe 98 PID 368 wrote to memory of 4944 368 cmd.exe 98 PID 368 wrote to memory of 4944 368 cmd.exe 98 PID 2192 wrote to memory of 3564 2192 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe"C:\Users\Admin\AppData\Local\Temp\19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:3580
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4696
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4736
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4492
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6132" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4016" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3292
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk82" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:328
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk88" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk88" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3564
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1908
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4896
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1800
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:2124
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:832
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1256
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4780
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD5e0eb584cff07c230b8452215da8dba6a
SHA16b164dfe92f08ca9b6254eab9a7221e8f185e335
SHA2560ce9225873e5093d9cb79a153e38240b6d264f54758f933bcff597b1ddc1f4a8
SHA51286f67cf4fb1568dc2d6d2dcb6c1a3a02a52cdda882a15b983cba18ae3e0c571ce95156ca89e6bb5b94423da69c82ec279807d36f17f4f0139d6aae1d08b3b181
-
Filesize
902KB
MD5e0eb584cff07c230b8452215da8dba6a
SHA16b164dfe92f08ca9b6254eab9a7221e8f185e335
SHA2560ce9225873e5093d9cb79a153e38240b6d264f54758f933bcff597b1ddc1f4a8
SHA51286f67cf4fb1568dc2d6d2dcb6c1a3a02a52cdda882a15b983cba18ae3e0c571ce95156ca89e6bb5b94423da69c82ec279807d36f17f4f0139d6aae1d08b3b181
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5b789b0dc77e5ebb9e378da98648687ef
SHA1146eab1023bf71746425a9cf8941a94d7bee721f
SHA256e2ba8e2460e3d1dfac0d9c7be470df4e6508900c3786ba74428e1e37d4b4a9ad
SHA512e1ac310c0259d0e4387ae20e73e4b259d1ce762905d9d8088cb37188a8efe6d9c3535b452f9760a691447c8b795365bb53747c21ae64b9671eb12d7f4939e48c