Analysis

  • max time kernel
    132s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-03-2021 22:27

General

  • Target

    2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe

  • Size

    534KB

  • MD5

    fda53610c25408e427c84eebdc5b8ec2

  • SHA1

    13830e44fb35c5f6d4750abd620ecb4df85e7a6a

  • SHA256

    2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb

  • SHA512

    617b6fb67057c7207cbe9f73be85b6f4d9d69462aee9b526a1bea085d1c101f7ff9da98da6a0e266bd49cafc41c0cdb741453bc76e9c09011bf4f1ec446f52e7

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe
    "C:\Users\Admin\AppData\Local\Temp\2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe"
    1⤵
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Injector" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:3856
    • C:\Users\Admin\AppData\Roaming\SubDir\Injector.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Injector.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Injector" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Injector.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:1932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3248
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        3⤵
          PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u991PXD4UBfm.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:1008
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            3⤵
            • Runs ping.exe
            PID:1312
          • C:\Users\Admin\AppData\Local\Temp\2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe
            "C:\Users\Admin\AppData\Local\Temp\2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3976

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3248-30-0x0000000007E30000-0x0000000007E31000-memory.dmp

        Filesize

        4KB

      • memory/3248-39-0x0000000009210000-0x0000000009243000-memory.dmp

        Filesize

        204KB

      • memory/3248-53-0x00000000096C0000-0x00000000096C1000-memory.dmp

        Filesize

        4KB

      • memory/3248-51-0x00000000096D0000-0x00000000096D1000-memory.dmp

        Filesize

        4KB

      • memory/3248-49-0x000000007E9A0000-0x000000007E9A1000-memory.dmp

        Filesize

        4KB

      • memory/3248-21-0x0000000073D40000-0x000000007442E000-memory.dmp

        Filesize

        6.9MB

      • memory/3248-22-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

        Filesize

        4KB

      • memory/3248-23-0x00000000074A0000-0x00000000074A1000-memory.dmp

        Filesize

        4KB

      • memory/3248-50-0x0000000006E63000-0x0000000006E64000-memory.dmp

        Filesize

        4KB

      • memory/3248-25-0x0000000006E60000-0x0000000006E61000-memory.dmp

        Filesize

        4KB

      • memory/3248-26-0x0000000006E62000-0x0000000006E63000-memory.dmp

        Filesize

        4KB

      • memory/3248-27-0x00000000073C0000-0x00000000073C1000-memory.dmp

        Filesize

        4KB

      • memory/3248-28-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

        Filesize

        4KB

      • memory/3248-48-0x0000000009720000-0x0000000009721000-memory.dmp

        Filesize

        4KB

      • memory/3248-31-0x0000000007B70000-0x0000000007B71000-memory.dmp

        Filesize

        4KB

      • memory/3248-32-0x00000000081C0000-0x00000000081C1000-memory.dmp

        Filesize

        4KB

      • memory/3248-37-0x00000000084B0000-0x00000000084B1000-memory.dmp

        Filesize

        4KB

      • memory/3248-47-0x0000000009560000-0x0000000009561000-memory.dmp

        Filesize

        4KB

      • memory/3248-46-0x00000000091F0000-0x00000000091F1000-memory.dmp

        Filesize

        4KB

      • memory/3620-6-0x0000000005020000-0x0000000005021000-memory.dmp

        Filesize

        4KB

      • memory/3620-10-0x0000000006290000-0x0000000006291000-memory.dmp

        Filesize

        4KB

      • memory/3620-2-0x0000000073D40000-0x000000007442E000-memory.dmp

        Filesize

        6.9MB

      • memory/3620-8-0x00000000051F0000-0x00000000051F1000-memory.dmp

        Filesize

        4KB

      • memory/3620-9-0x0000000005460000-0x0000000005461000-memory.dmp

        Filesize

        4KB

      • memory/3620-7-0x00000000050E0000-0x00000000050E1000-memory.dmp

        Filesize

        4KB

      • memory/3620-3-0x0000000000720000-0x0000000000721000-memory.dmp

        Filesize

        4KB

      • memory/3620-5-0x0000000005480000-0x0000000005481000-memory.dmp

        Filesize

        4KB

      • memory/3976-69-0x00000000057D0000-0x00000000057D1000-memory.dmp

        Filesize

        4KB

      • memory/3976-64-0x0000000073D40000-0x000000007442E000-memory.dmp

        Filesize

        6.9MB

      • memory/4028-57-0x0000000006500000-0x0000000006501000-memory.dmp

        Filesize

        4KB

      • memory/4028-24-0x0000000005140000-0x0000000005141000-memory.dmp

        Filesize

        4KB

      • memory/4028-16-0x0000000073D40000-0x000000007442E000-memory.dmp

        Filesize

        6.9MB