a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37

Resubmissions

08-06-2023 13:17

230608-qjqxdsff26 10

07-06-2023 15:10

230607-sj1gyaca54 10

Analysis

max time kernel
118s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bNqu.exe
Size

78KB
MD5

d4b127a7d4e2609d86747eadf6fd00ba
SHA1

88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab
SHA256

a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37
SHA512

f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488
SSDEEP

1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2832 schtasks.exe
1980 schtasks.exe
4780 schtasks.exe

pid	process
2832	schtasks.exe
1980	schtasks.exe
4780	schtasks.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

bNqu.exe

description	pid	process
Token: SeDebugPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe
Token: 33	1716	bNqu.exe
Token: SeIncBasePriorityPrivilege	1716	bNqu.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

bNqu.exebNqu.exebNqu.exe

description	pid	process	target process
PID 1716 wrote to memory of 1164	1716	bNqu.exe	schtasks.exe
PID 1716 wrote to memory of 1164	1716	bNqu.exe	schtasks.exe
PID 1716 wrote to memory of 1164	1716	bNqu.exe	schtasks.exe
PID 1716 wrote to memory of 2832	1716	bNqu.exe	schtasks.exe
PID 1716 wrote to memory of 2832	1716	bNqu.exe	schtasks.exe
PID 1716 wrote to memory of 2832	1716	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 3876	2940	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 3876	2940	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 3876	2940	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 1980	2940	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 1980	2940	bNqu.exe	schtasks.exe
PID 2940 wrote to memory of 1980	2940	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 3924	3500	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 3924	3500	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 3924	3500	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 4780	3500	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 4780	3500	bNqu.exe	schtasks.exe
PID 3500 wrote to memory of 4780	3500	bNqu.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
"C:\Users\Admin\AppData\Local\Temp\bNqu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:1164

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
2⤵
- Creates scheduled task(s)
PID:2832

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
C:\Users\Admin\AppData\Local\Temp\bNqu.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:3876

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
2⤵
- Creates scheduled task(s)
PID:1980

C:\Users\Admin\AppData\Local\Temp\bNqu.exe
C:\Users\Admin\AppData\Local\Temp\bNqu.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
2⤵
PID:3924

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\bNqu.exe" /sc minute /mo 1
2⤵
- Creates scheduled task(s)
PID:4780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bNqu.exe.log
Filesize
408B

MD5
661cab77d3b907e8057f2e689e995af3

SHA1
5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c

SHA256
8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2

SHA512
2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67

Download Submit
memory/1716-133-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/1716-134-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/2940-135-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3500-138-0x0000000001240000-0x0000000001250000-memory.dmp

Filesize
64KB

Download