Analysis
- max time kernel
150s - max time network
147s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
- Size 204KB
- Sample200624-mbenzd5h8a
- SHA256 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06
- MD5 36643dace9fdd4e729632b33204f6499
- SHA1 12a0e337894f802116e31c47fd0dbfdb81bd3217
- SHA512 7a282cc402c9d922c9483a11abdb44fec3a2bc61a6ec62be3a19d8cf291bc70d701089d841c87821f0bf271055f9665e9d170cb834a6e59e92d5450a4f5279ba
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 748 server.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe Token: 33 1512 dwam.exe Token: SeIncBasePriorityPrivilege 1512 dwam.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\c25cdf91e7e16aa9b34777d0cfae03fd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwam.exe\" .." dwam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c25cdf91e7e16aa9b34777d0cfae03fd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwam.exe\" .." dwam.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25cdf91e7e16aa9b34777d0cfae03fd.exe dwam.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25cdf91e7e16aa9b34777d0cfae03fd.exe dwam.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 896 wrote to memory of 748 896 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 24 PID 896 wrote to memory of 748 896 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 24 PID 896 wrote to memory of 748 896 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 24 PID 896 wrote to memory of 748 896 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 24 PID 748 wrote to memory of 1512 748 server.exe 25 PID 748 wrote to memory of 1512 748 server.exe 25 PID 748 wrote to memory of 1512 748 server.exe 25 PID 748 wrote to memory of 1512 748 server.exe 25 PID 1512 wrote to memory of 1816 1512 dwam.exe 26 PID 1512 wrote to memory of 1816 1512 dwam.exe 26 PID 1512 wrote to memory of 1816 1512 dwam.exe 26 PID 1512 wrote to memory of 1816 1512 dwam.exe 26 - Executes dropped EXE 2 IoCs
pid Process 748 server.exe 1512 dwam.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe"C:\Users\Admin\AppData\Local\Temp\3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\dwam.exe"C:\Users\Admin\AppData\Local\Temp\dwam.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Drops startup file
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dwam.exe" "dwam.exe" ENABLE4⤵
- Modifies service
PID:1816
-
-
-