General
-
Target
8f8d9d911765ac8c6f1ab6fdffadcc99.exe
-
Size
569KB
-
Sample
210602-9zwdapc2xs
-
MD5
8f8d9d911765ac8c6f1ab6fdffadcc99
-
SHA1
fff8ce05f5d9277f323581a0d2a497c348ba5b0c
-
SHA256
385b465f4265a093e38d831e885221c99ca8a1313d3ca30c4d32f6379d7b5428
-
SHA512
2aa37163c015799cde548ff3ee58bb188c5de6df84a96175a4bfa661f825c0fd30e68058818cb3975b581cd34f2d1b46617ffc89e4f2ee21df7509880d37c9c6
Static task
static1
Behavioral task
behavioral1
Sample
8f8d9d911765ac8c6f1ab6fdffadcc99.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
8f8d9d911765ac8c6f1ab6fdffadcc99.exe
Resource
win10v20210410
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
raccoon
e46634757936706c1ff491585768dd6fe231db30
-
url4cnc
https://tttttt.me/jdiamond13
Targets
-
-
Target
8f8d9d911765ac8c6f1ab6fdffadcc99.exe
-
Size
569KB
-
MD5
8f8d9d911765ac8c6f1ab6fdffadcc99
-
SHA1
fff8ce05f5d9277f323581a0d2a497c348ba5b0c
-
SHA256
385b465f4265a093e38d831e885221c99ca8a1313d3ca30c4d32f6379d7b5428
-
SHA512
2aa37163c015799cde548ff3ee58bb188c5de6df84a96175a4bfa661f825c0fd30e68058818cb3975b581cd34f2d1b46617ffc89e4f2ee21df7509880d37c9c6
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies RDP port number used by Windows
-
Possible privilege escalation attempt
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-