Analysis
-
max time kernel
12s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-12-2020 08:51
Static task
static1
Behavioral task
behavioral1
Sample
d6e428677d03e98845a2c84cb1e04ade.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d6e428677d03e98845a2c84cb1e04ade.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
d6e428677d03e98845a2c84cb1e04ade.exe
-
Size
100KB
-
MD5
d6e428677d03e98845a2c84cb1e04ade
-
SHA1
919abeb108f85e10cece90c349cea08043e307ca
-
SHA256
435a836a250603d3014f794b7123a5ed21d5481a4a86c10d669e8b1f71e9f113
-
SHA512
e0ebac44fd156eefd2861c908346baa900b45ee74c17bd11fc5ab903270d6817d5ffd87816c7ef510b70a3a964489108e33921d5409ab858d892abefff994e5c
Score
10/10
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
pid Process 2380 enterprise.exe -
Sets DLL path for service in the registry 2 TTPs
-
Loads dropped DLL 3 IoCs
pid Process 944 d6e428677d03e98845a2c84cb1e04ade.exe 4032 svchost.exe 2380 enterprise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\enterprise.exe svchost.exe File opened for modification C:\Windows\SysWOW64\enterprise.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 enterprise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz enterprise.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie enterprise.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" enterprise.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2916 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 d6e428677d03e98845a2c84cb1e04ade.exe 944 d6e428677d03e98845a2c84cb1e04ade.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe 2380 enterprise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 944 d6e428677d03e98845a2c84cb1e04ade.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 944 d6e428677d03e98845a2c84cb1e04ade.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 944 wrote to memory of 852 944 d6e428677d03e98845a2c84cb1e04ade.exe 78 PID 944 wrote to memory of 852 944 d6e428677d03e98845a2c84cb1e04ade.exe 78 PID 944 wrote to memory of 852 944 d6e428677d03e98845a2c84cb1e04ade.exe 78 PID 852 wrote to memory of 2916 852 cmd.exe 80 PID 852 wrote to memory of 2916 852 cmd.exe 80 PID 852 wrote to memory of 2916 852 cmd.exe 80 PID 4032 wrote to memory of 2380 4032 svchost.exe 81 PID 4032 wrote to memory of 2380 4032 svchost.exe 81 PID 4032 wrote to memory of 2380 4032 svchost.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6e428677d03e98845a2c84cb1e04ade.exe"C:\Users\Admin\AppData\Local\Temp\d6e428677d03e98845a2c84cb1e04ade.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\d6e428677d03e98845a2c84cb1e04ade.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:2916
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵PID:3280
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\enterprise.exeC:\Windows\system32\enterprise.exe "c:\users\admin\appdata\local\temp\259298843.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2380
-