Analysis
-
max time kernel
186s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:33
Behavioral task
behavioral1
Sample
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe
Resource
win7-20221111-en
General
-
Target
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe
-
Size
58KB
-
MD5
9a6e0eb8386fb225b18ddeba4dc37dde
-
SHA1
d39354adf203eb35712c84286e6cf55c9628f0d2
-
SHA256
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36
-
SHA512
c8ab4515bf579d155415734624a18850551d73c8c34ebc4312cbad829dd82509dbab970f70733419bb89d380cff6d869bf402f4fc6265d207bb384565263ed1c
-
SSDEEP
1536:2KLQlni5AbO4+4UsmhFBsx2GCnLRkIhuiD:2KN5cmix2GiLRrui
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral1/memory/824-54-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-63-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exepid process 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe -
Drops file in System32 directory 9 IoCs
Processes:
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exedescription ioc process File created C:\Windows\SysWOW64\midimap.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\dllcache\midimap.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File opened for modification C:\Windows\SysWOW64\yuksuser.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\yumidimap.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\ksuser.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\dllcache\ksuser.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\VZODHOJJ10.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\VZODHOJJ.ime 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe File created C:\Windows\SysWOW64\yuksuser.dll 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 904 sc.exe 1640 sc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exepid process 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exedescription pid process Token: SeDebugPrivilege 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe Token: SeDebugPrivilege 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exenet.exedescription pid process target process PID 824 wrote to memory of 1280 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe Explorer.EXE PID 824 wrote to memory of 944 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe net.exe PID 824 wrote to memory of 944 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe net.exe PID 824 wrote to memory of 944 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe net.exe PID 824 wrote to memory of 944 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe net.exe PID 824 wrote to memory of 904 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 904 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 904 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 904 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 1640 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 1640 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 1640 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 824 wrote to memory of 1640 824 7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe sc.exe PID 944 wrote to memory of 520 944 net.exe net1.exe PID 944 wrote to memory of 520 944 net.exe net1.exe PID 944 wrote to memory of 520 944 net.exe net1.exe PID 944 wrote to memory of 520 944 net.exe net1.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe"C:\Users\Admin\AppData\Local\Temp\7016cbad218f7011451a06eabe962cc66f5dd32038f61253ff4a6b189bbd4c36.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop cryptsvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop cryptsvc4⤵
-
C:\Windows\SysWOW64\sc.exesc config cryptsvc start= disabled3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete cryptsvc3⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\VZODHOJJ.imeFilesize
6KB
MD5281b64bbd2ef8735a55e29bf2561dda7
SHA1a579005b30f85bdbdab013832638bdbcfd00ff31
SHA2566ef3cc0a6f10da8e23fc961006fb025a98d83b75171364909669f21a2eb40607
SHA5125f915d49a0da0e1e528cfb42c7b46f2f204320b68b7a137a5e083cb8e66da5765c292a8e03b27c4c5d7d722bd82fbe1a549326d58e9fe2aeb011433ddef6751c
-
\Windows\SysWOW64\VZODHOJJ.imeFilesize
6KB
MD5281b64bbd2ef8735a55e29bf2561dda7
SHA1a579005b30f85bdbdab013832638bdbcfd00ff31
SHA2566ef3cc0a6f10da8e23fc961006fb025a98d83b75171364909669f21a2eb40607
SHA5125f915d49a0da0e1e528cfb42c7b46f2f204320b68b7a137a5e083cb8e66da5765c292a8e03b27c4c5d7d722bd82fbe1a549326d58e9fe2aeb011433ddef6751c
-
\Windows\SysWOW64\VZODHOJJ.imeFilesize
6KB
MD5281b64bbd2ef8735a55e29bf2561dda7
SHA1a579005b30f85bdbdab013832638bdbcfd00ff31
SHA2566ef3cc0a6f10da8e23fc961006fb025a98d83b75171364909669f21a2eb40607
SHA5125f915d49a0da0e1e528cfb42c7b46f2f204320b68b7a137a5e083cb8e66da5765c292a8e03b27c4c5d7d722bd82fbe1a549326d58e9fe2aeb011433ddef6751c
-
\Windows\SysWOW64\VZODHOJJ.imeFilesize
6KB
MD5281b64bbd2ef8735a55e29bf2561dda7
SHA1a579005b30f85bdbdab013832638bdbcfd00ff31
SHA2566ef3cc0a6f10da8e23fc961006fb025a98d83b75171364909669f21a2eb40607
SHA5125f915d49a0da0e1e528cfb42c7b46f2f204320b68b7a137a5e083cb8e66da5765c292a8e03b27c4c5d7d722bd82fbe1a549326d58e9fe2aeb011433ddef6751c
-
memory/520-62-0x0000000000000000-mapping.dmp
-
memory/824-54-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/824-63-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/904-56-0x0000000000000000-mapping.dmp
-
memory/944-55-0x0000000000000000-mapping.dmp
-
memory/1640-57-0x0000000000000000-mapping.dmp