Analysis
- max time kernel
149s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
29/06/2020, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe
- Size 31KB
- Sample200629-9lzddynhan
- SHA256 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
- MD5 919be51c3ea49b6d87a141272d319975
- SHA1 8c429c37fa3356b4b699ac378e44d4c757bf0825
- SHA512 f2e1af27a5ef78a9eb4f21bcd5b95a3608396bc95f9cab53f40e04dd062707717543c9937c4551540fba7566c9157e329195233286a58947996e96203524da4e
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3024 1536 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 67 PID 1536 wrote to memory of 3024 1536 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 67 PID 1536 wrote to memory of 3024 1536 c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe 67 PID 3024 wrote to memory of 1944 3024 RATATA.exe 68 PID 3024 wrote to memory of 1944 3024 RATATA.exe 68 PID 3024 wrote to memory of 1944 3024 RATATA.exe 68 - Executes dropped EXE 1 IoCs
pid Process 3024 RATATA.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe Token: 33 3024 RATATA.exe Token: SeIncBasePriorityPrivilege 3024 RATATA.exe - Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe"C:\Users\Admin\AppData\Local\Temp\c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\RATATA.exe"C:\Users\Admin\AppData\Local\Temp\RATATA.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\RATATA.exe" "RATATA.exe" ENABLE3⤵PID:1944
-
-