oblique | 9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c | Triage

Analysis

max time kernel
140s
max time network
151s
platform
windows10_x64
resource
win10v200722
submitted
28-08-2020 12:55

Sharing

Report Analysis Logs

General

Target

lphsi.bin.exe
Size

201KB
MD5

0bafccfaec9c7d45ce491e4b0ddc1bdf
SHA1

f0fa26da45d04ca36e9eb0acbc2d8ddce881e096
SHA256

9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c
SHA512

c32b734420be1ee3a54dfea117f2fb14353fbd39831d8bbe8a4515c983f0781c38d4bcc8a6c5fd0785693fa3a16add499387bd8add21f706c9927d537e38184e

Score

10^/10

trojan oblique

Malware Config

Signatures

ObliqueRAT
Remote Access Trojan discovered in early 2020.
trojan oblique

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = ffbcfbb74b7dd601	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1780	svchost.exe
Token: SeCreatePagefilePrivilege	1780	svchost.exe

C:\Users\Admin\AppData\Local\Temp\lphsi.bin.exe
"C:\Users\Admin\AppData\Local\Temp\lphsi.bin.exe"
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads