Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2023 15:10
Behavioral task
behavioral1
Sample
bNqu.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
bNqu.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
bNqu.exe
-
Size
78KB
-
MD5
d4b127a7d4e2609d86747eadf6fd00ba
-
SHA1
88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab
-
SHA256
a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37
-
SHA512
f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488
-
SSDEEP
1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM
Score
1/10
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bNqu.exedescription pid process Token: SeDebugPrivilege 4280 bNqu.exe Token: 33 4280 bNqu.exe Token: SeIncBasePriorityPrivilege 4280 bNqu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
bNqu.execmd.exedescription pid process target process PID 4280 wrote to memory of 5116 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 5116 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 5116 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3724 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3724 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3724 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3324 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3324 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 3324 4280 bNqu.exe schtasks.exe PID 4280 wrote to memory of 464 4280 bNqu.exe cmd.exe PID 4280 wrote to memory of 464 4280 bNqu.exe cmd.exe PID 4280 wrote to memory of 464 4280 bNqu.exe cmd.exe PID 464 wrote to memory of 1288 464 cmd.exe PING.EXE PID 464 wrote to memory of 1288 464 cmd.exe PING.EXE PID 464 wrote to memory of 1288 464 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\bNqu.exe"C:\Users\Admin\AppData\Local\Temp\bNqu.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\bNqu.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 0 -n 23⤵
- Runs ping.exe