Analysis
- max time kernel
151s - max time network
142s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
- Size 499KB
- Sample201113-e75b4t3ttj
- SHA256 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0
- MD5 faa4dd7e33869cc28dacaad1db904118
- SHA1 93e66ff675f563ca5d3df6fb3388155429f04efe
- SHA512 81a40e58d3f8bfe35b6ef2960c384513bfe1e46e5e8e426e51f552febafe1d1d75df53d0d28941308fd4db4ccf4d616a18d64f339b81db79371d470ee2896dde
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1916 000.exe 1768 Server.exe 808 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1ff9fa41877bbbbcfd97c7b5e079246.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1ff9fa41877bbbbcfd97c7b5e079246.exe server.exe - Loads dropped DLL 5 IoCs
pid Process 1964 cmd.exe 1916 000.exe 1916 000.exe 1916 000.exe 1768 Server.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e1ff9fa41877bbbbcfd97c7b5e079246 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\e1ff9fa41877bbbbcfd97c7b5e079246 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe Token: 33 808 server.exe Token: SeIncBasePriorityPrivilege 808 server.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1964 1668 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 26 PID 1668 wrote to memory of 1964 1668 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 26 PID 1668 wrote to memory of 1964 1668 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 26 PID 1668 wrote to memory of 1964 1668 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 26 PID 1964 wrote to memory of 1916 1964 cmd.exe 28 PID 1964 wrote to memory of 1916 1964 cmd.exe 28 PID 1964 wrote to memory of 1916 1964 cmd.exe 28 PID 1964 wrote to memory of 1916 1964 cmd.exe 28 PID 1916 wrote to memory of 1768 1916 000.exe 29 PID 1916 wrote to memory of 1768 1916 000.exe 29 PID 1916 wrote to memory of 1768 1916 000.exe 29 PID 1916 wrote to memory of 1768 1916 000.exe 29 PID 1768 wrote to memory of 808 1768 Server.exe 33 PID 1768 wrote to memory of 808 1768 Server.exe 33 PID 1768 wrote to memory of 808 1768 Server.exe 33 PID 1768 wrote to memory of 808 1768 Server.exe 33 PID 808 wrote to memory of 824 808 server.exe 34 PID 808 wrote to memory of 824 808 server.exe 34 PID 808 wrote to memory of 824 808 server.exe 34 PID 808 wrote to memory of 824 808 server.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe"C:\Users\Admin\AppData\Local\Temp\b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\0.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\000.exe000.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵
- Modifies service
PID:824
-
-
-
-
-