Analysis
-
max time kernel
124s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-12-2020 07:40
Static task
static1
Behavioral task
behavioral1
Sample
08d49d88c70b139a00f9eb87de734644.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
08d49d88c70b139a00f9eb87de734644.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
08d49d88c70b139a00f9eb87de734644.exe
-
Size
100KB
-
MD5
08d49d88c70b139a00f9eb87de734644
-
SHA1
1624a339f5bdfd5f166c211b5d4f06ab489cd406
-
SHA256
9b1367b0da26125af6946a108e9e657c373ad4e25be8e9a9eaa3a29adf6c95d9
-
SHA512
ae06bff8cd9f6d8a0cd07da540122d6bfb26c7061c7a2f3d6d1cf5b547ee73e67a321ac6600016e5c2ae3c8c599533442930454f8ac180696fd6ce5f9b0e7cb4
Score
10/10
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
pid Process 2644 enterprise.exe -
Sets DLL path for service in the registry 2 TTPs
-
Loads dropped DLL 3 IoCs
pid Process 4068 08d49d88c70b139a00f9eb87de734644.exe 2040 svchost.exe 2644 enterprise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\enterprise.exe svchost.exe File opened for modification C:\Windows\SysWOW64\enterprise.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 enterprise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz enterprise.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie enterprise.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2660 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4068 08d49d88c70b139a00f9eb87de734644.exe 4068 08d49d88c70b139a00f9eb87de734644.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe 2644 enterprise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4068 08d49d88c70b139a00f9eb87de734644.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4068 08d49d88c70b139a00f9eb87de734644.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4068 wrote to memory of 2516 4068 08d49d88c70b139a00f9eb87de734644.exe 77 PID 4068 wrote to memory of 2516 4068 08d49d88c70b139a00f9eb87de734644.exe 77 PID 4068 wrote to memory of 2516 4068 08d49d88c70b139a00f9eb87de734644.exe 77 PID 2516 wrote to memory of 2660 2516 cmd.exe 80 PID 2516 wrote to memory of 2660 2516 cmd.exe 80 PID 2516 wrote to memory of 2660 2516 cmd.exe 80 PID 2040 wrote to memory of 2644 2040 svchost.exe 83 PID 2040 wrote to memory of 2644 2040 svchost.exe 83 PID 2040 wrote to memory of 2644 2040 svchost.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\08d49d88c70b139a00f9eb87de734644.exe"C:\Users\Admin\AppData\Local\Temp\08d49d88c70b139a00f9eb87de734644.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\08d49d88c70b139a00f9eb87de734644.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:2660
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵PID:1664
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\enterprise.exeC:\Windows\system32\enterprise.exe "c:\users\admin\appdata\local\temp\259273062.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2644
-