Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-12-2020 08:23
Static task
static1
Behavioral task
behavioral1
Sample
af9faa36dfa99d285a266bc0f11d6436.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
af9faa36dfa99d285a266bc0f11d6436.exe
Resource
win10v20201028
General
-
Target
af9faa36dfa99d285a266bc0f11d6436.exe
-
Size
100KB
-
MD5
af9faa36dfa99d285a266bc0f11d6436
-
SHA1
78cdd663c8a7fafdedf787aa56ada343dae051ce
-
SHA256
ef03a58568ec094636fe33261e1fafbb6aa77125be68c3615da4823abba198d8
-
SHA512
ed8a80b6994f6dc4702de6568b84e9fc7b344e00dddfd4def847dcbb852ef8b295a3979aae20e5601c302ef5af180d095600e791ba95bf973ed24e854edab304
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
pid Process 732 enterprise.exe -
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1244 cmd.exe -
Loads dropped DLL 7 IoCs
pid Process 1048 af9faa36dfa99d285a266bc0f11d6436.exe 2024 svchost.exe 2024 svchost.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\enterprise.exe svchost.exe File opened for modification C:\Windows\SysWOW64\enterprise.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 enterprise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz enterprise.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum enterprise.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software enterprise.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft enterprise.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie enterprise.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1116 PING.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1048 af9faa36dfa99d285a266bc0f11d6436.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe 732 enterprise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1048 af9faa36dfa99d285a266bc0f11d6436.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1048 af9faa36dfa99d285a266bc0f11d6436.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1048 wrote to memory of 1244 1048 af9faa36dfa99d285a266bc0f11d6436.exe 28 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 1244 wrote to memory of 1116 1244 cmd.exe 30 PID 2024 wrote to memory of 732 2024 svchost.exe 34 PID 2024 wrote to memory of 732 2024 svchost.exe 34 PID 2024 wrote to memory of 732 2024 svchost.exe 34 PID 2024 wrote to memory of 732 2024 svchost.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:1116
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵PID:2012
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\enterprise.exeC:\Windows\system32\enterprise.exe "c:\users\admin\appdata\local\temp\259271118.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:732
-