61322bfef06e7fda9e84ad05a402f63f3ece7013120081ca2d3cdbfd4cfbc807

General

Target
Server.bin.exe
Size 43KB
Sample200727-8vsgr4mspe
SHA256 61322bfef06e7fda9e84ad05a402f63f3ece7013120081ca2d3cdbfd4cfbc807
MD5 c8d3124da2597ed5622840c8129bd6f6
SHA1 89c54d4fbf67f8b9a98532eae5bfc60b18cf581a
SHA512 4706afac2135eab020e133794c6a6a308cfd087c3ead1691467b787fb2a02a8f498f2f7d29944a3b6317177059de17870052939a45b94af8fbfe9d5034fd9de8
MD5 SHA1 SHA512

Score

8^/10

Loads dropped DLL 1 IoCs

pid	Process
1516	Server.bin.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1780	1516	Server.bin.exe	24
PID 1516 wrote to memory of 1780	1516	Server.bin.exe	24
PID 1516 wrote to memory of 1780	1516	Server.bin.exe	24
PID 1516 wrote to memory of 1780	1516	Server.bin.exe	24
PID 1780 wrote to memory of 1852	1780	Trojan.exe	25
PID 1780 wrote to memory of 1852	1780	Trojan.exe	25
PID 1780 wrote to memory of 1852	1780	Trojan.exe	25
PID 1780 wrote to memory of 1852	1780	Trojan.exe	25

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

Modify Existing Service

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	Trojan.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1780	Trojan.exe
1780	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe	Trojan.exe