Analysis
-
max time kernel
5s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-12-2020 07:39
Static task
static1
Behavioral task
behavioral1
Sample
cdc887bb5bff153dcff3330f0fbb9bdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cdc887bb5bff153dcff3330f0fbb9bdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
cdc887bb5bff153dcff3330f0fbb9bdf.exe
-
Size
100KB
-
MD5
cdc887bb5bff153dcff3330f0fbb9bdf
-
SHA1
1465f62b20e495cf9a12bc4faac5246cc0c2db3b
-
SHA256
0175a29f801ef7a555c3d20744a5fa5336604d420d8ffe98bb5723744d1a82cd
-
SHA512
30f5a6dbed556ebd99fd339222012e5f7d401486995147b68b63490244c4d20cf11ad1588d159f8e23807125ecd2383e9228a3a69dc553741a67eda508ddabe7
Score
10/10
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
pid Process 1080 enterprise.exe -
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1192 cmd.exe -
Loads dropped DLL 7 IoCs
pid Process 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 1256 svchost.exe 1256 svchost.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\enterprise.exe svchost.exe File created C:\Windows\SysWOW64\enterprise.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 enterprise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz enterprise.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft enterprise.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie enterprise.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" enterprise.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1964 PING.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe 1080 enterprise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1640 wrote to memory of 1192 1640 cdc887bb5bff153dcff3330f0fbb9bdf.exe 28 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1192 wrote to memory of 1964 1192 cmd.exe 30 PID 1256 wrote to memory of 1080 1256 svchost.exe 34 PID 1256 wrote to memory of 1080 1256 svchost.exe 34 PID 1256 wrote to memory of 1080 1256 svchost.exe 34 PID 1256 wrote to memory of 1080 1256 svchost.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdc887bb5bff153dcff3330f0fbb9bdf.exe"C:\Users\Admin\AppData\Local\Temp\cdc887bb5bff153dcff3330f0fbb9bdf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\cdc887bb5bff153dcff3330f0fbb9bdf.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:1964
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵PID:1188
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "enterprise"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\enterprise.exeC:\Windows\system32\enterprise.exe "c:\users\admin\appdata\local\temp\259270931.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1080
-