Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
memdump_E30_03193020_a6fe0.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
memdump_E30_03193020_a6fe0.exe
-
Size
667KB
-
MD5
015fb753dee2c3553aefee19a57c08fe
-
SHA1
6e0a0dc558965ac251796711450e54394951fc20
-
SHA256
9ac77e13a14e9ad81b44b48d7ed3c9a73ad0c75fca74ff5271faaae6c15dd974
-
SHA512
9f8cf9315f7a504c67fafb83d2e44cab9cabdc2a43accfe1874ecf05d9019af9ef0af14d9046d95cbd2252003b67f01d43e2bf4e502ac3cae50f16e2dd99061d
-
SSDEEP
6144:BKUjrESZxB5+TlkJUjvvh02jwipRISx61Po4WSXp:lr3xB5+JM+6owizHx4o4WSX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1488 sysras.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2e7a6119 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\sysras.exe" memdump_E30_03193020_a6fe0.exe -
Script User-Agent 18 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 71 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 76 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 47 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 58 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 56 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 59 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 74 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 49 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 51 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 78 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 79 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 55 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 75 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 73 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 77 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 53 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 57 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1216 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1216 taskmgr.exe Token: SeSystemProfilePrivilege 1216 taskmgr.exe Token: SeCreateGlobalPrivilege 1216 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe 1216 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3968 memdump_E30_03193020_a6fe0.exe 1488 sysras.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1488 3968 memdump_E30_03193020_a6fe0.exe 92 PID 3968 wrote to memory of 1488 3968 memdump_E30_03193020_a6fe0.exe 92 PID 3968 wrote to memory of 1488 3968 memdump_E30_03193020_a6fe0.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\memdump_E30_03193020_a6fe0.exe"C:\Users\Admin\AppData\Local\Temp\memdump_E30_03193020_a6fe0.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sysras.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sysras.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD5015fb753dee2c3553aefee19a57c08fe
SHA16e0a0dc558965ac251796711450e54394951fc20
SHA2569ac77e13a14e9ad81b44b48d7ed3c9a73ad0c75fca74ff5271faaae6c15dd974
SHA5129f8cf9315f7a504c67fafb83d2e44cab9cabdc2a43accfe1874ecf05d9019af9ef0af14d9046d95cbd2252003b67f01d43e2bf4e502ac3cae50f16e2dd99061d
-
Filesize
667KB
MD5015fb753dee2c3553aefee19a57c08fe
SHA16e0a0dc558965ac251796711450e54394951fc20
SHA2569ac77e13a14e9ad81b44b48d7ed3c9a73ad0c75fca74ff5271faaae6c15dd974
SHA5129f8cf9315f7a504c67fafb83d2e44cab9cabdc2a43accfe1874ecf05d9019af9ef0af14d9046d95cbd2252003b67f01d43e2bf4e502ac3cae50f16e2dd99061d