Analysis
-
max time kernel
75s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-12-2020 08:23
Static task
static1
Behavioral task
behavioral1
Sample
af9faa36dfa99d285a266bc0f11d6436.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
af9faa36dfa99d285a266bc0f11d6436.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
af9faa36dfa99d285a266bc0f11d6436.exe
-
Size
100KB
-
MD5
af9faa36dfa99d285a266bc0f11d6436
-
SHA1
78cdd663c8a7fafdedf787aa56ada343dae051ce
-
SHA256
ef03a58568ec094636fe33261e1fafbb6aa77125be68c3615da4823abba198d8
-
SHA512
ed8a80b6994f6dc4702de6568b84e9fc7b344e00dddfd4def847dcbb852ef8b295a3979aae20e5601c302ef5af180d095600e791ba95bf973ed24e854edab304
Score
10/10
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
pid Process 3620 enterprise.exe -
Sets DLL path for service in the registry 2 TTPs
-
Loads dropped DLL 3 IoCs
pid Process 3160 af9faa36dfa99d285a266bc0f11d6436.exe 888 svchost.exe 3620 enterprise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\enterprise.exe svchost.exe File opened for modification C:\Windows\SysWOW64\enterprise.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 enterprise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz enterprise.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie enterprise.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft enterprise.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2820 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 af9faa36dfa99d285a266bc0f11d6436.exe 3160 af9faa36dfa99d285a266bc0f11d6436.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe 3620 enterprise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3160 af9faa36dfa99d285a266bc0f11d6436.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3160 af9faa36dfa99d285a266bc0f11d6436.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2456 3160 af9faa36dfa99d285a266bc0f11d6436.exe 76 PID 3160 wrote to memory of 2456 3160 af9faa36dfa99d285a266bc0f11d6436.exe 76 PID 3160 wrote to memory of 2456 3160 af9faa36dfa99d285a266bc0f11d6436.exe 76 PID 2456 wrote to memory of 2820 2456 cmd.exe 78 PID 2456 wrote to memory of 2820 2456 cmd.exe 78 PID 2456 wrote to memory of 2820 2456 cmd.exe 78 PID 888 wrote to memory of 3620 888 svchost.exe 82 PID 888 wrote to memory of 3620 888 svchost.exe 82 PID 888 wrote to memory of 3620 888 svchost.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\af9faa36dfa99d285a266bc0f11d6436.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:2820
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵PID:804
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\enterprise.exeC:\Windows\system32\enterprise.exe "c:\users\admin\appdata\local\temp\259272203.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3620
-