samorat | f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea

General

Target

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Size

188KB
MD5

4bb3e58d375714e27744d106143cf61b
SHA1

802803b91e9439c5bc0a59f73629d2a191e9f4dc
SHA256

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea
SHA512

64cf58bbc58f05d6d08bdf59ce5b7496bf4a4ae97135d8a96c4ed6af7ae319a2b146d79059ff718d481f26198b1f80874fb7111c8bd79fda039e21db3f9424f7

Score

10^/10

persistence trojan samorat

Malware Config

Signatures

SamoRAT
SamoRAT is a .NET malware used to receive and execute different commands on the infected system.
trojan samorat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 icanhazip.com

flow	ioc
4	icanhazip.com

Modifies service 2 TTPs 30 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rdyboost\Performance\1023 = "132387669328718000"	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BITS\Performance\1008 = "132387669316394000"	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1022 = "132387669317330000"	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "2"	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1056 schtasks.exe

pid	process
1056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

pid	process
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

description pid process

Token: SeDebugPrivilege 900 f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

description	pid	process
Token: SeDebugPrivilege	900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1072	900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe	cmd.exe
PID 900 wrote to memory of 1072	900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe	cmd.exe
PID 900 wrote to memory of 1072	900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe	cmd.exe
PID 900 wrote to memory of 1072	900	f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe	cmd.exe
PID 1072 wrote to memory of 1056	1072	cmd.exe	schtasks.exe
PID 1072 wrote to memory of 1056	1072	cmd.exe	schtasks.exe
PID 1072 wrote to memory of 1056	1072	cmd.exe	schtasks.exe
PID 1072 wrote to memory of 1056	1072	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
"C:\Users\Admin\AppData\Local\Temp\f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe"
1⤵
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-2-0x0000000006990000-0x00000000069A1000-memory.dmp

Filesize
68KB

Download
memory/900-3-0x0000000006990000-0x00000000069A1000-memory.dmp

Filesize
68KB

Download
memory/900-4-0x0000000006990000-0x00000000069A1000-memory.dmp

Filesize
68KB

Download
memory/900-5-0x00000000074B0000-0x00000000074C1000-memory.dmp

Filesize
68KB

Download
memory/900-6-0x00000000075B0000-0x00000000075C1000-memory.dmp

Filesize
68KB

Download
memory/1056-1-0x0000000000000000-mapping.dmp

Download
memory/1072-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads