Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
07-05-2021 05:17
Static task
static1
Behavioral task
behavioral1
Sample
x64.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
x64.exe
Resource
win10v20210410
General
-
Target
x64.exe
-
Size
32KB
-
MD5
e65f3463068c583ba9ec1aabc08d1cd5
-
SHA1
97eca180a490fbf6fdbbb96eee1769d315594ad7
-
SHA256
8af4a9ab3943a49bda13ba1af87ea3a5934efb29b3f0de9284744a155cab0f0f
-
SHA512
a552b3a386e89a3e04fa85d9dbee2557ee7c44e8be33ebb33f3f9bb00eb3392b6b10f733092e93831a47ea7ac5bec316e6d970d7026227595951103009e22b05
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
Processes:
serviecs.exepid process 292 serviecs.exe -
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1988 cmd.exe -
Loads dropped DLL 7 IoCs
Processes:
x64.exesvchost.exeserviecs.exepid process 1828 x64.exe 1308 svchost.exe 1308 svchost.exe 292 serviecs.exe 292 serviecs.exe 292 serviecs.exe 292 serviecs.exe -
Drops file in System32 directory 3 IoCs
Processes:
x64.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259293739.dll x64.exe File created C:\Windows\SysWOW64\serviecs.exe svchost.exe File opened for modification C:\Windows\SysWOW64\serviecs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
x64.exepid process 1828 x64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
x64.exedescription pid process Token: SeIncBasePriorityPrivilege 1828 x64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
x64.exepid process 1828 x64.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
x64.execmd.exesvchost.exedescription pid process target process PID 1828 wrote to memory of 1988 1828 x64.exe cmd.exe PID 1828 wrote to memory of 1988 1828 x64.exe cmd.exe PID 1828 wrote to memory of 1988 1828 x64.exe cmd.exe PID 1828 wrote to memory of 1988 1828 x64.exe cmd.exe PID 1988 wrote to memory of 668 1988 cmd.exe PING.EXE PID 1988 wrote to memory of 668 1988 cmd.exe PING.EXE PID 1988 wrote to memory of 668 1988 cmd.exe PING.EXE PID 1988 wrote to memory of 668 1988 cmd.exe PING.EXE PID 1308 wrote to memory of 292 1308 svchost.exe serviecs.exe PID 1308 wrote to memory of 292 1308 svchost.exe serviecs.exe PID 1308 wrote to memory of 292 1308 svchost.exe serviecs.exe PID 1308 wrote to memory of 292 1308 svchost.exe serviecs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x64.exe"C:\Users\Admin\AppData\Local\Temp\x64.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\x64.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serviecs"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serviecs"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\serviecs.exeC:\Windows\system32\serviecs.exe "c:\windows\system32\259293739.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\serviecs.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
C:\Windows\SysWOW64\serviecs.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
\??\c:\windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\259293739.dllMD5
e3f051a6c1ae27a5fc8efb5ad735c601
SHA13b7e18d31de8b271c1abc90c680b93d7fedf8099
SHA256c2cf550da41a39951c12fb292ccbdf47f80fd9d8e0d7cea94e7393d7ef44a55b
SHA512c85ace6fc70690e0c90b8849efb4f0fbb4de020250c77d439b55d3b12722af2582f9c5ecfd1570ffb80a860c7a0530e8a7973c7cd1f5d1b4eafd05b411b14ae8
-
\Windows\SysWOW64\serviecs.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/292-67-0x0000000000000000-mapping.dmp
-
memory/668-65-0x0000000000000000-mapping.dmp
-
memory/1828-60-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/1988-64-0x0000000000000000-mapping.dmp