Analysis
- max time kernel
148s - max time network
156s - platform
windows7_x64 - resource
win7v200430 - submitted
29/06/2020, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe
- Size 31KB
- Sample200629-9lzddynhan
- SHA256 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
- MD5 919be51c3ea49b6d87a141272d319975
- SHA1 8c429c37fa3356b4b699ac378e44d4c757bf0825
- SHA512 f2e1af27a5ef78a9eb4f21bcd5b95a3608396bc95f9cab53f40e04dd062707717543c9937c4551540fba7566c9157e329195233286a58947996e96203524da4e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe - Loads dropped DLL 1 IoCs
pid Process 1020 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1020 wrote to memory of 552 1020 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 24 PID 1020 wrote to memory of 552 1020 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 24 PID 1020 wrote to memory of 552 1020 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 24 PID 1020 wrote to memory of 552 1020 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 24 PID 552 wrote to memory of 1804 552 RATATA.exe 27 PID 552 wrote to memory of 1804 552 RATATA.exe 27 PID 552 wrote to memory of 1804 552 RATATA.exe 27 PID 552 wrote to memory of 1804 552 RATATA.exe 27 - Executes dropped EXE 1 IoCs
pid Process 552 RATATA.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe Token: 33 552 RATATA.exe Token: SeIncBasePriorityPrivilege 552 RATATA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe"C:\Users\Admin\AppData\Local\Temp\c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\RATATA.exe"C:\Users\Admin\AppData\Local\Temp\RATATA.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\RATATA.exe" "RATATA.exe" ENABLE3⤵
- Modifies service
PID:1804
-
-