General
-
Target
e9f7040390e3052baacd0e25e6186e01.exe
-
Size
567KB
-
Sample
210602-fqjz7glnve
-
MD5
e9f7040390e3052baacd0e25e6186e01
-
SHA1
f0df3a95add27f0c8482a33fb3ee2998a73adfb3
-
SHA256
2c5105d428486ab9bd43df850f2b74e9250769976662bc9937128ce0ff6257b0
-
SHA512
6e3fa85236d0b75fe59d31749ab3e8bfab3652813a71575244f8b3e2312df4eca6a14c54612223b98bee31922aa78b00df71824b0208f64744661c5693282263
Static task
static1
Behavioral task
behavioral1
Sample
e9f7040390e3052baacd0e25e6186e01.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e9f7040390e3052baacd0e25e6186e01.exe
Resource
win10v20210408
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
raccoon
e46634757936706c1ff491585768dd6fe231db30
-
url4cnc
https://tttttt.me/jdiamond13
Targets
-
-
Target
e9f7040390e3052baacd0e25e6186e01.exe
-
Size
567KB
-
MD5
e9f7040390e3052baacd0e25e6186e01
-
SHA1
f0df3a95add27f0c8482a33fb3ee2998a73adfb3
-
SHA256
2c5105d428486ab9bd43df850f2b74e9250769976662bc9937128ce0ff6257b0
-
SHA512
6e3fa85236d0b75fe59d31749ab3e8bfab3652813a71575244f8b3e2312df4eca6a14c54612223b98bee31922aa78b00df71824b0208f64744661c5693282263
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies RDP port number used by Windows
-
Possible privilege escalation attempt
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-