Analysis
- max time kernel
150s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe
- Size 499KB
- Sample201113-e75b4t3ttj
- SHA256 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0
- MD5 faa4dd7e33869cc28dacaad1db904118
- SHA1 93e66ff675f563ca5d3df6fb3388155429f04efe
- SHA512 81a40e58d3f8bfe35b6ef2960c384513bfe1e46e5e8e426e51f552febafe1d1d75df53d0d28941308fd4db4ccf4d616a18d64f339b81db79371d470ee2896dde
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 512 000.exe 2424 Server.exe 3864 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1ff9fa41877bbbbcfd97c7b5e079246.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1ff9fa41877bbbbcfd97c7b5e079246.exe server.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\e1ff9fa41877bbbbcfd97c7b5e079246 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e1ff9fa41877bbbbcfd97c7b5e079246 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe Token: 33 3864 server.exe Token: SeIncBasePriorityPrivilege 3864 server.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1172 wrote to memory of 3992 1172 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 73 PID 1172 wrote to memory of 3992 1172 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 73 PID 1172 wrote to memory of 3992 1172 b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe 73 PID 3992 wrote to memory of 512 3992 cmd.exe 77 PID 3992 wrote to memory of 512 3992 cmd.exe 77 PID 3992 wrote to memory of 512 3992 cmd.exe 77 PID 512 wrote to memory of 2424 512 000.exe 79 PID 512 wrote to memory of 2424 512 000.exe 79 PID 512 wrote to memory of 2424 512 000.exe 79 PID 2424 wrote to memory of 3864 2424 Server.exe 84 PID 2424 wrote to memory of 3864 2424 Server.exe 84 PID 2424 wrote to memory of 3864 2424 Server.exe 84 PID 3864 wrote to memory of 1152 3864 server.exe 85 PID 3864 wrote to memory of 1152 3864 server.exe 85 PID 3864 wrote to memory of 1152 3864 server.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe"C:\Users\Admin\AppData\Local\Temp\b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\0.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\000.exe000.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵PID:1152
-
-
-
-
-