Analysis
-
max time kernel
180s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe
-
Size
209KB
-
MD5
c0d62caa0437de0a41c61e5584a29594
-
SHA1
200037c27215b5d9c7cb994bc96192da3e1d1e3d
-
SHA256
90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1
-
SHA512
f8ffd8932e22c07a05decfcf59e4d654f82d12ad0b6d65d7b032ff924785a0d654b67257c060e15bb59a0f19d9ff60bd605ad9d66d1026fbf96c0accfbbc36f3
-
SSDEEP
6144:X4Csg/wAcsP4YeUPeYOwToSAw3HgNzx5Nod38:ovdAFChSATV5N+M
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4032 ilpun.exe 4140 ilpun.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\Currentversion\Run ilpun.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ybylyq = "C:\\Users\\Admin\\AppData\\Roaming\\Oqqy\\ilpun.exe" ilpun.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\Currentversion\Run ilpun.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4516 set thread context of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4032 set thread context of 4140 4032 ilpun.exe 86 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe 4140 ilpun.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe Token: SeSecurityPrivilege 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4516 wrote to memory of 4160 4516 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 84 PID 4160 wrote to memory of 4032 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 85 PID 4160 wrote to memory of 4032 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 85 PID 4160 wrote to memory of 4032 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 85 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4032 wrote to memory of 4140 4032 ilpun.exe 86 PID 4140 wrote to memory of 2528 4140 ilpun.exe 24 PID 4140 wrote to memory of 2528 4140 ilpun.exe 24 PID 4140 wrote to memory of 2528 4140 ilpun.exe 24 PID 4140 wrote to memory of 2528 4140 ilpun.exe 24 PID 4140 wrote to memory of 2528 4140 ilpun.exe 24 PID 4160 wrote to memory of 3616 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 87 PID 4160 wrote to memory of 3616 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 87 PID 4160 wrote to memory of 3616 4160 90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe 87 PID 4140 wrote to memory of 2580 4140 ilpun.exe 57 PID 4140 wrote to memory of 2580 4140 ilpun.exe 57 PID 4140 wrote to memory of 2580 4140 ilpun.exe 57 PID 4140 wrote to memory of 2580 4140 ilpun.exe 57 PID 4140 wrote to memory of 2580 4140 ilpun.exe 57 PID 4140 wrote to memory of 2808 4140 ilpun.exe 26 PID 4140 wrote to memory of 2808 4140 ilpun.exe 26 PID 4140 wrote to memory of 2808 4140 ilpun.exe 26 PID 4140 wrote to memory of 2808 4140 ilpun.exe 26 PID 4140 wrote to memory of 2808 4140 ilpun.exe 26 PID 4140 wrote to memory of 1068 4140 ilpun.exe 53 PID 4140 wrote to memory of 1068 4140 ilpun.exe 53 PID 4140 wrote to memory of 1068 4140 ilpun.exe 53 PID 4140 wrote to memory of 1068 4140 ilpun.exe 53 PID 4140 wrote to memory of 1068 4140 ilpun.exe 53 PID 4140 wrote to memory of 3104 4140 ilpun.exe 27 PID 4140 wrote to memory of 3104 4140 ilpun.exe 27 PID 4140 wrote to memory of 3104 4140 ilpun.exe 27 PID 4140 wrote to memory of 3104 4140 ilpun.exe 27 PID 4140 wrote to memory of 3104 4140 ilpun.exe 27 PID 4140 wrote to memory of 3296 4140 ilpun.exe 52 PID 4140 wrote to memory of 3296 4140 ilpun.exe 52 PID 4140 wrote to memory of 3296 4140 ilpun.exe 52 PID 4140 wrote to memory of 3296 4140 ilpun.exe 52 PID 4140 wrote to memory of 3296 4140 ilpun.exe 52 PID 4140 wrote to memory of 3392 4140 ilpun.exe 51 PID 4140 wrote to memory of 3392 4140 ilpun.exe 51 PID 4140 wrote to memory of 3392 4140 ilpun.exe 51 PID 4140 wrote to memory of 3392 4140 ilpun.exe 51 PID 4140 wrote to memory of 3392 4140 ilpun.exe 51 PID 4140 wrote to memory of 3464 4140 ilpun.exe 28 PID 4140 wrote to memory of 3464 4140 ilpun.exe 28 PID 4140 wrote to memory of 3464 4140 ilpun.exe 28 PID 4140 wrote to memory of 3464 4140 ilpun.exe 28 PID 4140 wrote to memory of 3464 4140 ilpun.exe 28 PID 4140 wrote to memory of 3560 4140 ilpun.exe 50 PID 4140 wrote to memory of 3560 4140 ilpun.exe 50
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2528
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3104
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3464
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2844
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4788
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3560
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3392
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3296
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe"C:\Users\Admin\AppData\Local\Temp\90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exeC:\Users\Admin\AppData\Local\Temp\90d8055f8858c99a1c735436d42bbe1ff54363c9428b927c2eb7edbba45cf6c1.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Roaming\Oqqy\ilpun.exe"C:\Users\Admin\AppData\Roaming\Oqqy\ilpun.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Roaming\Oqqy\ilpun.exeC:\Users\Admin\AppData\Roaming\Oqqy\ilpun.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb8374bc2.bat"4⤵PID:3616
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4300
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2620
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1172
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4428
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD585bf258f854d61d551749beeb8d0c3cc
SHA10cdb3a11861a8b39653a3503681d6eaddcfedc8c
SHA256a7408c55736c6c3c68777e6349416c4783f96f2f3a9301e1166521324d97cb9e
SHA512a510244a229880426f65bb55edb2c3477a9e1972e67ef639561679560c0671933d1f9739453dec7c1759db024d5c614cff0e63764946e395a8b21a94d0ef2394
-
Filesize
209KB
MD5c206175fb6dc67318a02294b0fdba143
SHA1bb04325f4b1cf3364645011983ece6fce10b2849
SHA256161681c17a808ad1696a75963e4a4b3eedf09e8e08a396fe98188223f3b52297
SHA512dc9e95468f0c671b97faf7b8f5d7778fcb640a19bfd69422383dcd59a9687f6edb120d81bbbde6d15b0ffd90fcabc61fa205ffb6abc1db213a85f15c5b796758
-
Filesize
209KB
MD5c206175fb6dc67318a02294b0fdba143
SHA1bb04325f4b1cf3364645011983ece6fce10b2849
SHA256161681c17a808ad1696a75963e4a4b3eedf09e8e08a396fe98188223f3b52297
SHA512dc9e95468f0c671b97faf7b8f5d7778fcb640a19bfd69422383dcd59a9687f6edb120d81bbbde6d15b0ffd90fcabc61fa205ffb6abc1db213a85f15c5b796758
-
Filesize
209KB
MD5c206175fb6dc67318a02294b0fdba143
SHA1bb04325f4b1cf3364645011983ece6fce10b2849
SHA256161681c17a808ad1696a75963e4a4b3eedf09e8e08a396fe98188223f3b52297
SHA512dc9e95468f0c671b97faf7b8f5d7778fcb640a19bfd69422383dcd59a9687f6edb120d81bbbde6d15b0ffd90fcabc61fa205ffb6abc1db213a85f15c5b796758