f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea

General
Target

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

Filesize

188KB

Completed

09-07-2020 11:17

Score
10 /10
MD5

4bb3e58d375714e27744d106143cf61b

SHA1

802803b91e9439c5bc0a59f73629d2a191e9f4dc

SHA256

f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea

Malware Config
Signatures 7

Filter: none

Defense Evasion
Persistence
  • SamoRAT

    Description

    SamoRAT is a .NET malware used to receive and execute different commands on the infected system.

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    2icanhazip.com
  • Modifies service
    f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rdyboost\Performance\1023 = "132387741261541719"f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performancef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Set value (data)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkagef434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    3816schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

    Reported IOCs

    pidprocess
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
  • Suspicious use of AdjustPrivilegeToken
    f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
  • Suspicious use of WriteProcessMemory
    f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 992 wrote to memory of 2680992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.execmd.exe
    PID 992 wrote to memory of 2680992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.execmd.exe
    PID 992 wrote to memory of 2680992f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.execmd.exe
    PID 2680 wrote to memory of 38162680cmd.exeschtasks.exe
    PID 2680 wrote to memory of 38162680cmd.exeschtasks.exe
    PID 2680 wrote to memory of 38162680cmd.exeschtasks.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe
    "C:\Users\Admin\AppData\Local\Temp\f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea.exe"
    Modifies service
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:992
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit
      Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'
        Creates scheduled task(s)
        PID:3816
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    PID:1812
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/992-6-0x0000000007250000-0x0000000007251000-memory.dmp

                      • memory/992-2-0x0000000007250000-0x0000000007251000-memory.dmp

                      • memory/992-3-0x0000000007250000-0x0000000007251000-memory.dmp

                      • memory/992-4-0x0000000007250000-0x0000000007251000-memory.dmp

                      • memory/992-5-0x0000000007250000-0x0000000007251000-memory.dmp

                      • memory/2680-0-0x0000000000000000-mapping.dmp

                      • memory/3816-1-0x0000000000000000-mapping.dmp