a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37

Resubmissions

08-06-2023 13:17

230608-qjqxdsff26 10

07-06-2023 15:10

230607-sj1gyaca54 10

Analysis

max time kernel
94s
max time network
99s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bNqu.exe
Size

78KB
MD5

d4b127a7d4e2609d86747eadf6fd00ba
SHA1

88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab
SHA256

a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37
SHA512

f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488
SSDEEP

1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1692 schtasks.exe
556 schtasks.exe
892 schtasks.exe

pid	process
1692	schtasks.exe
556	schtasks.exe
892	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

bNqu.exe

description	pid	process
Token: SeDebugPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe
Token: 33	592	bNqu.exe
Token: SeIncBasePriorityPrivilege	592	bNqu.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

bNqu.exetaskeng.exebNqu.exebNqu.exe

description	pid	process	target process
PID 592 wrote to memory of 928	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 928	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 928	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 928	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 1692	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 1692	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 1692	592	bNqu.exe	schtasks.exe
PID 592 wrote to memory of 1692	592	bNqu.exe	schtasks.exe
PID 1584 wrote to memory of 1576	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 1576	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 1576	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 1576	1584	taskeng.exe	bNqu.exe
PID 1576 wrote to memory of 1568	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 1568	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 1568	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 1568	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 556	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 556	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 556	1576	bNqu.exe	schtasks.exe
PID 1576 wrote to memory of 556	1576	bNqu.exe	schtasks.exe
PID 1584 wrote to memory of 860	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 860	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 860	1584	taskeng.exe	bNqu.exe
PID 1584 wrote to memory of 860	1584	taskeng.exe	bNqu.exe
PID 860 wrote to memory of 740	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 740	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 740	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 740	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 892	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 892	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 892	860	bNqu.exe	schtasks.exe
PID 860 wrote to memory of 892	860	bNqu.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
"C:\Users\Admin\AppData\Local\Temp\bNqu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:928

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
2⤵
- Creates scheduled task(s)
PID:1692

C:\Windows\system32\taskeng.exe
taskeng.exe {2FF8E96B-1A67-4A3B-82B8-7A9B65C671D7} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
C:\Users\Admin\AppData\Local\Temp\bNqu.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:556

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
C:\Users\Admin\AppData\Local\Temp\bNqu.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:740

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-54-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/592-56-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/860-57-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/1576-55-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download