876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

Analysis

max time kernel
277s
max time network
304s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe
Size

4.8MB
MD5

80750ddfb5cfe9eb8e2adac60f372534
SHA1

a720efe2b3ef7735efd77de698a5576b36068d07
SHA256

876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04
SHA512

bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f
SSDEEP

49152:RAM2vrGxtRJHHc1RmqAhaShRgdGMYYqWxvdTBB0IEqYjla27EdS5g+A:mMgGxtU1RmqA3xsquvPEdZi+A

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1196	svcupdater.exe

Loads dropped DLL 2 IoCs

pid	Process
584	taskeng.exe
584	taskeng.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
948	schtasks.exe

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	10	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	9	Go-http-client/1.1

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 820	1140	876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe	26
PID 1140 wrote to memory of 820	1140	876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe	26
PID 1140 wrote to memory of 820	1140	876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe	26
PID 820 wrote to memory of 948	820	cmd.exe	28
PID 820 wrote to memory of 948	820	cmd.exe	28
PID 820 wrote to memory of 948	820	cmd.exe	28
PID 584 wrote to memory of 1196	584	taskeng.exe	30
PID 584 wrote to memory of 1196	584	taskeng.exe	30
PID 584 wrote to memory of 1196	584	taskeng.exe	30

C:\Users\Admin\AppData\Local\Temp\876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe
"C:\Users\Admin\AppData\Local\Temp\876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\system32\cmd.exe
  cmd.exe "/C schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
    3⤵
    - Creates scheduled task(s)
    PID:948

C:\Windows\system32\taskeng.exe
taskeng.exe {981D5DE6-BE12-40F8-A171-E01C780BC55F} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
  2⤵
  - Executes dropped EXE
  PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads