855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3

Analysis

max time kernel
146s
max time network
136s
platform
windows7_x64
resource
win7v200430
submitted
13/05/2020, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
Size

88KB
MD5

a4e1caab1b9642ef645b6549ca09d303
SHA1

da0cd782f32088c0df8cd62deda1c61b4cedd6fb
SHA256

855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3
SHA512

7bfac7c52b00928a28dbcdf73f50401e1be2177540c7473de20f8058e49f46eb6d508eb9eac090c2b25d61e507e839da1404b4da3f66fc10e54797023d7659ae

Score

6^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24
PID 288 wrote to memory of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 108	288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe	24

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
288	855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
108	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
"C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...