a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37

Resubmissions

08-06-2023 13:17

230608-qjqxdsff26 10

07-06-2023 15:10

230607-sj1gyaca54 10

Analysis

max time kernel
37s
max time network
38s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bNqu.exe
Size

78KB
MD5

d4b127a7d4e2609d86747eadf6fd00ba
SHA1

88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab
SHA256

a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37
SHA512

f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488
SSDEEP

1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1500 cmd.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

852 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

920 PING.EXE

pid	process
1500	cmd.exe

pid	process
852	schtasks.exe

pid	process
920	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

bNqu.exe

description	pid	process
Token: SeDebugPrivilege	1236	bNqu.exe
Token: 33	1236	bNqu.exe
Token: SeIncBasePriorityPrivilege	1236	bNqu.exe
Token: 33	1236	bNqu.exe
Token: SeIncBasePriorityPrivilege	1236	bNqu.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

bNqu.execmd.exe

description	pid	process	target process
PID 1236 wrote to memory of 1904	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1904	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1904	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1904	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 852	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 852	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 852	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 852	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1424	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1424	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1424	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1424	1236	bNqu.exe	schtasks.exe
PID 1236 wrote to memory of 1500	1236	bNqu.exe	cmd.exe
PID 1236 wrote to memory of 1500	1236	bNqu.exe	cmd.exe
PID 1236 wrote to memory of 1500	1236	bNqu.exe	cmd.exe
PID 1236 wrote to memory of 1500	1236	bNqu.exe	cmd.exe
PID 1500 wrote to memory of 920	1500	cmd.exe	PING.EXE
PID 1500 wrote to memory of 920	1500	cmd.exe	PING.EXE
PID 1500 wrote to memory of 920	1500	cmd.exe	PING.EXE
PID 1500 wrote to memory of 920	1500	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
"C:\Users\Admin\AppData\Local\Temp\bNqu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:1904

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
2⤵
- Creates scheduled task(s)
PID:852

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:1424

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\bNqu.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\PING.EXE
ping 0 -n 2
3⤵
- Runs ping.exe
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-54-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/1236-55-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/1236-56-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download