Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v200722 - submitted
12/09/2020, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
069TuMRk.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
069TuMRk.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 069TuMRk.exe
- Size 23KB
- Sample200912-eet2nywzje
- SHA256 c89a6d3e5dc8dbea3f29a1f904fcc006630eba45b6f472592eaedd893f0af32f
- MD5 a50feab9c37e505bac453316203915aa
- SHA1 89bae786b3a2b0c4c2d9299353177d1816275629
- SHA512 2c102c0ce2e6bf448e91d6445dc93535a214bc0405a90e1db1c0a7a4b39baf1ee0242a77317e46cf9f4d86216232a286325930486594743373c0c13bbae7d886
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3036 sdan.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\497f64fc5a86087f222cf3d499bc7ef3.exe sdan.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\497f64fc5a86087f222cf3d499bc7ef3.exe sdan.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\497f64fc5a86087f222cf3d499bc7ef3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\sdan.exe\" .." sdan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\497f64fc5a86087f222cf3d499bc7ef3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\sdan.exe\" .." sdan.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe Token: 33 3036 sdan.exe Token: SeIncBasePriorityPrivilege 3036 sdan.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 584 wrote to memory of 3036 584 069TuMRk.exe 75 PID 584 wrote to memory of 3036 584 069TuMRk.exe 75 PID 584 wrote to memory of 3036 584 069TuMRk.exe 75 PID 3036 wrote to memory of 3056 3036 sdan.exe 77 PID 3036 wrote to memory of 3056 3036 sdan.exe 77 PID 3036 wrote to memory of 3056 3036 sdan.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\069TuMRk.exe"C:\Users\Admin\AppData\Local\Temp\069TuMRk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Roaming\sdan.exe"C:\Users\Admin\AppData\Roaming\sdan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\sdan.exe" "sdan.exe" ENABLE3⤵PID:3056
-
-