Analysis
- max time kernel
151s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe
- Size 877KB
- Sample200624-dft6wc8l66
- SHA256 73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd
- MD5 457944c45a1a52c833cc9599ec110664
- SHA1 245fb3fe20923f95402f75d88e5e70f6531d36e3
- SHA512 3be2aee109e0e48393a6e10af3588a3a98c92430ee44e7940d7532c6c04c043daff7ede41999de83dfcc2e426153843622824d442711c18f98ee30df43e9e102
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3880 Runtime Boker.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe Token: 33 3880 Runtime Boker.exe Token: SeIncBasePriorityPrivilege 3880 Runtime Boker.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\c50a5232fad6a264894fa4e4ebfa922a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Runtime Boker.exe\" .." Runtime Boker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c50a5232fad6a264894fa4e4ebfa922a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Runtime Boker.exe\" .." Runtime Boker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3880 3788 73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe 67 PID 3788 wrote to memory of 3880 3788 73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe 67 PID 3788 wrote to memory of 3880 3788 73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe 67 PID 3880 wrote to memory of 3196 3880 Runtime Boker.exe 68 PID 3880 wrote to memory of 3196 3880 Runtime Boker.exe 68 PID 3880 wrote to memory of 3196 3880 Runtime Boker.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe"C:\Users\Admin\AppData\Local\Temp\73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\Runtime Boker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Boker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Runtime Boker.exe" "Runtime Boker.exe" ENABLE3⤵PID:3196
-
-