Overview

overview

10

Static

static

inn.bin.exe

windows7_x64

1

inn.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    31/10/2020, 18:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    inn.bin.exe

  • Size

    155KB

  • MD5

    af568e8a6060812f040f0cb0fd6f5a7b

  • SHA1

    e7f0c17b338d78c4f8b82b032af9f81828512b30

  • SHA256

    3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9

  • SHA512

    2c44272dcf130a95ea0e83fa02d2629edecf94b16452127f2e177f00f4bf48f2e306ec53b28d2005a27e8b683dc683fb54146a711233aa1e1c4256a9e4ac979b

Score
1/10

Malware Config

Signatures

  • Kills process with taskkill 20 IoCs
    evasion
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 364 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\inn.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\inn.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "mysql*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1588
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "dsa*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1684
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "Ntrtscan*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "ds_monitor*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1968
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "Notifier*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1796
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "TmListen*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1752
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "iVPAgent*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1800
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "CNTAoSMgr*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:296
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IBM*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1728
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "bes10*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1116
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "black*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "robo*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:268
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "copy*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:552
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "store.exe"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:956
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "sql*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "vee*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:916
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "wrsa*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1320
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "wrsa.exe"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1792
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "postg*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:576
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "sage*"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1920
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100"
      2⤵
        PID:1996
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
          3⤵
            PID:3236
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "MSSQL$ISARS"
          2⤵
            PID:1580
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "MSSQL$ISARS"
              3⤵
                PID:3516
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "MSSQL$MSFW"
              2⤵
                PID:1608
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "MSSQL$MSFW"
                  3⤵
                    PID:3228
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "SQLAgent$ISARS"
                  2⤵
                    PID:2064
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "SQLAgent$ISARS"
                      3⤵
                        PID:3220
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop "SQLAgent$MSFW"
                      2⤵
                        PID:2088
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop "SQLAgent$MSFW"
                          3⤵
                            PID:3592
                        • C:\Windows\SysWOW64\net.exe
                          "C:\Windows\System32\net.exe" stop "SQLBrowser"
                          2⤵
                            PID:2104
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "SQLBrowser"
                              3⤵
                                PID:3472
                            • C:\Windows\SysWOW64\net.exe
                              "C:\Windows\System32\net.exe" stop "ReportServer$ISARS"
                              2⤵
                                PID:2128
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop "ReportServer$ISARS"
                                  3⤵
                                    PID:3772
                                • C:\Windows\SysWOW64\net.exe
                                  "C:\Windows\System32\net.exe" stop "SQLWriter"
                                  2⤵
                                    PID:2152
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop "SQLWriter"
                                      3⤵
                                        PID:3644
                                    • C:\Windows\SysWOW64\net.exe
                                      "C:\Windows\System32\net.exe" stop "WinDefend"
                                      2⤵
                                        PID:2176
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop "WinDefend"
                                          3⤵
                                            PID:3668
                                        • C:\Windows\SysWOW64\net.exe
                                          "C:\Windows\System32\net.exe" stop "mr2kserv"
                                          2⤵
                                            PID:2200
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop "mr2kserv"
                                              3⤵
                                                PID:3564
                                            • C:\Windows\SysWOW64\net.exe
                                              "C:\Windows\System32\net.exe" stop "MSExchangeADTopology"
                                              2⤵
                                                PID:2224
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop "MSExchangeADTopology"
                                                  3⤵
                                                    PID:3276
                                                • C:\Windows\SysWOW64\net.exe
                                                  "C:\Windows\System32\net.exe" stop "MSExchangeFBA"
                                                  2⤵
                                                    PID:2256
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop "MSExchangeFBA"
                                                      3⤵
                                                        PID:3720
                                                    • C:\Windows\SysWOW64\net.exe
                                                      "C:\Windows\System32\net.exe" stop "MSExchangeIS"
                                                      2⤵
                                                        PID:2272
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 stop "MSExchangeIS"
                                                          3⤵
                                                            PID:3292
                                                        • C:\Windows\SysWOW64\net.exe
                                                          "C:\Windows\System32\net.exe" stop "MSExchangeSA"
                                                          2⤵
                                                            PID:2304
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop "MSExchangeSA"
                                                              3⤵
                                                                PID:3284
                                                            • C:\Windows\SysWOW64\net.exe
                                                              "C:\Windows\System32\net.exe" stop "ShadowProtectSvc"
                                                              2⤵
                                                                PID:2328
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "ShadowProtectSvc"
                                                                  3⤵
                                                                    PID:3680
                                                                • C:\Windows\SysWOW64\net.exe
                                                                  "C:\Windows\System32\net.exe" stop "SPAdminV4"
                                                                  2⤵
                                                                    PID:2344
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop "SPAdminV4"
                                                                      3⤵
                                                                        PID:3808
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      "C:\Windows\System32\net.exe" stop "SPTimerV4"
                                                                      2⤵
                                                                        PID:2368
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop "SPTimerV4"
                                                                          3⤵
                                                                            PID:3572
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          "C:\Windows\System32\net.exe" stop "SPTraceV4"
                                                                          2⤵
                                                                            PID:2392
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop "SPTraceV4"
                                                                              3⤵
                                                                                PID:3656
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              "C:\Windows\System32\net.exe" stop "SPUserCodeV4"
                                                                              2⤵
                                                                                PID:2416
                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                  C:\Windows\system32\net1 stop "SPUserCodeV4"
                                                                                  3⤵
                                                                                    PID:3300
                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                  "C:\Windows\System32\net.exe" stop "SPWriterV4"
                                                                                  2⤵
                                                                                    PID:2448
                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                      C:\Windows\system32\net1 stop "SPWriterV4"
                                                                                      3⤵
                                                                                        PID:3584
                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                      "C:\Windows\System32\net.exe" stop "SPSearch4"
                                                                                      2⤵
                                                                                        PID:2464
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 stop "SPSearch4"
                                                                                          3⤵
                                                                                            PID:3464
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100"
                                                                                          2⤵
                                                                                            PID:2488
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
                                                                                              3⤵
                                                                                                PID:3636
                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                              "C:\Windows\System32\net.exe" stop "IISADMIN"
                                                                                              2⤵
                                                                                                PID:2512
                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                  C:\Windows\system32\net1 stop "IISADMIN"
                                                                                                  3⤵
                                                                                                    PID:3268
                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                  "C:\Windows\System32\net.exe" stop "firebirdguardiandefaultinstance"
                                                                                                  2⤵
                                                                                                    PID:2548
                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                      C:\Windows\system32\net1 stop "firebirdguardiandefaultinstance"
                                                                                                      3⤵
                                                                                                        PID:3440
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      "C:\Windows\System32\net.exe" stop "ibmiasrw"
                                                                                                      2⤵
                                                                                                        PID:2664
                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                          C:\Windows\system32\net1 stop "ibmiasrw"
                                                                                                          3⤵
                                                                                                            PID:3728
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          "C:\Windows\System32\net.exe" stop "QBCFMonitorService"
                                                                                                          2⤵
                                                                                                            PID:2760
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop "QBCFMonitorService"
                                                                                                              3⤵
                                                                                                                PID:3500
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              "C:\Windows\System32\net.exe" stop "QBVSS"
                                                                                                              2⤵
                                                                                                                PID:2804
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 stop "QBVSS"
                                                                                                                  3⤵
                                                                                                                    PID:3880
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  "C:\Windows\System32\net.exe" stop "QBPOSDBServiceV12"
                                                                                                                  2⤵
                                                                                                                    PID:2836
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop "QBPOSDBServiceV12"
                                                                                                                      3⤵
                                                                                                                        PID:3604
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      "C:\Windows\System32\net.exe" stop "IBM Domino Server(CProgramFilesIBMDominodata)"
                                                                                                                      2⤵
                                                                                                                        PID:2896
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 stop "IBM Domino Server(CProgramFilesIBMDominodata)"
                                                                                                                          3⤵
                                                                                                                            PID:3860
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          "C:\Windows\System32\net.exe" stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
                                                                                                                          2⤵
                                                                                                                            PID:2936
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
                                                                                                                              3⤵
                                                                                                                                PID:3624
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              "C:\Windows\System32\net.exe" stop "IISADMIN"
                                                                                                                              2⤵
                                                                                                                                PID:3024
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 stop "IISADMIN"
                                                                                                                                  3⤵
                                                                                                                                    PID:3612
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  "C:\Windows\System32\net.exe" stop "Simply Accounting Database Connection Manager"
                                                                                                                                  2⤵
                                                                                                                                    PID:2140
                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                      C:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"
                                                                                                                                      3⤵
                                                                                                                                        PID:3484
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      "C:\Windows\System32\net.exe" stop "QuickBooksDB1"
                                                                                                                                      2⤵
                                                                                                                                        PID:2252
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 stop "QuickBooksDB1"
                                                                                                                                          3⤵
                                                                                                                                            PID:3508
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          "C:\Windows\System32\net.exe" stop "QuickBooksDB2"
                                                                                                                                          2⤵
                                                                                                                                            PID:2340
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "QuickBooksDB2"
                                                                                                                                              3⤵
                                                                                                                                                PID:3552
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              "C:\Windows\System32\net.exe" stop "QuickBooksDB3"
                                                                                                                                              2⤵
                                                                                                                                                PID:2476
                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                  C:\Windows\system32\net1 stop "QuickBooksDB3"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3708
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  "C:\Windows\System32\net.exe" stop "QuickBooksDB4"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2540

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Matrix

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads