Analysis
- max time kernel
149s - max time network
147s - platform
windows10_x64 - resource
win10v200430 - submitted
29/06/2020, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe
- Size 166KB
- Sample200629-p78rxvxm42
- SHA256 dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa
- MD5 e56da594bb0724839366522ff0b42d3b
- SHA1 5ac613667bf66afe9a6715af1d8d472ccf967769
- SHA512 c80bbeb7db636b67bcc46c6e3a9c8f8063c39e83623fe60416925409a7b65f677fc7aad1169ee7323e892a9988b2978df598f22543df92ca01480ecdeba02fad
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\0f281b12f603c40d203a8a7911c030da = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0f281b12f603c40d203a8a7911c030da = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 896 wrote to memory of 1792 896 dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe 68 PID 896 wrote to memory of 1792 896 dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe 68 PID 896 wrote to memory of 1792 896 dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe 68 PID 1792 wrote to memory of 2872 1792 server.exe 73 PID 1792 wrote to memory of 2872 1792 server.exe 73 PID 1792 wrote to memory of 2872 1792 server.exe 73 - Executes dropped EXE 1 IoCs
pid Process 1792 server.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe Token: 33 1792 server.exe Token: SeIncBasePriorityPrivilege 1792 server.exe - Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe"C:\Users\Admin\AppData\Local\Temp\dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵PID:2872
-
-