Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-05-2021 12:43
Static task
static1
Behavioral task
behavioral1
Sample
0abfe7296d6ef7efd02d77248cbaffb3.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
0abfe7296d6ef7efd02d77248cbaffb3.exe
Resource
win10v20210408
General
-
Target
0abfe7296d6ef7efd02d77248cbaffb3.exe
-
Size
112KB
-
MD5
0abfe7296d6ef7efd02d77248cbaffb3
-
SHA1
fa7741429e5fb7143aa59b2e6179809b8a88bbe4
-
SHA256
08626ceda0fe99bd888c612e6935330f3fbc6775d1be5d1e6e8cd934365549c0
-
SHA512
c04a7b80818716f460d0e6f4df4e5e65600e794294348ae4ff2923a973e2b7e9c0be163de6d74c5e8a1c5ffaeb50ab9a0788bfdd780cccf6fd61457fc157ec1b
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 376 csrss.exe -
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1796 cmd.exe -
Loads dropped DLL 7 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.exesvchost.execsrss.exepid process 336 0abfe7296d6ef7efd02d77248cbaffb3.exe 1984 svchost.exe 1984 svchost.exe 376 csrss.exe 376 csrss.exe 376 csrss.exe 376 csrss.exe -
Drops file in System32 directory 3 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259260885.dll 0abfe7296d6ef7efd02d77248cbaffb3.exe File created C:\Windows\SysWOW64\csrss.exe svchost.exe File opened for modification C:\Windows\SysWOW64\csrss.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.exepid process 336 0abfe7296d6ef7efd02d77248cbaffb3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.exedescription pid process Token: SeIncBasePriorityPrivilege 336 0abfe7296d6ef7efd02d77248cbaffb3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.exepid process 336 0abfe7296d6ef7efd02d77248cbaffb3.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0abfe7296d6ef7efd02d77248cbaffb3.execmd.exesvchost.exedescription pid process target process PID 336 wrote to memory of 1796 336 0abfe7296d6ef7efd02d77248cbaffb3.exe cmd.exe PID 336 wrote to memory of 1796 336 0abfe7296d6ef7efd02d77248cbaffb3.exe cmd.exe PID 336 wrote to memory of 1796 336 0abfe7296d6ef7efd02d77248cbaffb3.exe cmd.exe PID 336 wrote to memory of 1796 336 0abfe7296d6ef7efd02d77248cbaffb3.exe cmd.exe PID 1796 wrote to memory of 1800 1796 cmd.exe PING.EXE PID 1796 wrote to memory of 1800 1796 cmd.exe PING.EXE PID 1796 wrote to memory of 1800 1796 cmd.exe PING.EXE PID 1796 wrote to memory of 1800 1796 cmd.exe PING.EXE PID 1984 wrote to memory of 376 1984 svchost.exe csrss.exe PID 1984 wrote to memory of 376 1984 svchost.exe csrss.exe PID 1984 wrote to memory of 376 1984 svchost.exe csrss.exe PID 1984 wrote to memory of 376 1984 svchost.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0abfe7296d6ef7efd02d77248cbaffb3.exe"C:\Users\Admin\AppData\Local\Temp\0abfe7296d6ef7efd02d77248cbaffb3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\0abfe7296d6ef7efd02d77248cbaffb3.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "csrss"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "csrss"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\csrss.exeC:\Windows\system32\csrss.exe "c:\windows\system32\259260885.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\csrss.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
C:\Windows\SysWOW64\csrss.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
\??\c:\windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\259260885.dllMD5
563aacbb7eeb2182187da4e74bf0c6ee
SHA199ae0203f98523dfad235fa1731ebc7f6727182b
SHA2567426c530fd590058f5352f4507d2f872be65fae2a5b440c746374e4caf04b763
SHA512d13fc689879de8bcf358b390f5a1c26e8b493b5f34e614f658ec814dad577b11cfc6fe15633f4ad76f5c5a9de03a688328c639723765740acecc4bf8ffaf4240
-
\Windows\SysWOW64\csrss.exeMD5
51138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/336-60-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/376-67-0x0000000000000000-mapping.dmp
-
memory/1796-64-0x0000000000000000-mapping.dmp
-
memory/1800-65-0x0000000000000000-mapping.dmp