7a4c304b810703f0eb30ae166efb16ff9c1cfb0ebc9db5948e959614a3e49d5d

Analysis

max time kernel
119s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
08/01/2022, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bc6b19a38122b926c4e3a5872283c56.exe
Size 6.9MB
Sample220108-h8y1asdcbr
SHA256 7a4c304b810703f0eb30ae166efb16ff9c1cfb0ebc9db5948e959614a3e49d5d
MD5 6bc6b19a38122b926c4e3a5872283c56
SHA1 cd00b7f70a26a5c5cb1d775cb25fec8827c8309f
SHA512 029b897815f65a4b9b1ea6c41952f71d490e5530086cca0c0bb35394e9ddf99562ca74fa18bc4495f8168216e13958610fd18fa43dcf761ddb3d1df99fc838d4
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE SpyAgent C&C Activity (Request)
suricata: ET MALWARE SpyAgent C&C Activity (Request)
suricata
suricata: ET MALWARE Win32.Spy/TVRat Checkin
suricata: ET MALWARE Win32.Spy/TVRat Checkin
suricata

Executes dropped EXE 1 IoCs

pid	Process
696	ast.exe

Loads dropped DLL 15 IoCs

pid	Process
2656	6bc6b19a38122b926c4e3a5872283c56.exe
2656	6bc6b19a38122b926c4e3a5872283c56.exe
2656	6bc6b19a38122b926c4e3a5872283c56.exe
2656	6bc6b19a38122b926c4e3a5872283c56.exe
2656	6bc6b19a38122b926c4e3a5872283c56.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe
696	ast.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	ast.exe
696	ast.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2656	6bc6b19a38122b926c4e3a5872283c56.exe
Token: SeDebugPrivilege	696	ast.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
696	ast.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1312	2656	6bc6b19a38122b926c4e3a5872283c56.exe	68
PID 2656 wrote to memory of 1312	2656	6bc6b19a38122b926c4e3a5872283c56.exe	68
PID 2656 wrote to memory of 1312	2656	6bc6b19a38122b926c4e3a5872283c56.exe	68
PID 1312 wrote to memory of 696	1312	cmd.exe	70
PID 1312 wrote to memory of 696	1312	cmd.exe	70
PID 1312 wrote to memory of 696	1312	cmd.exe	70

C:\Users\Admin\AppData\Local\Temp\6bc6b19a38122b926c4e3a5872283c56.exe
"C:\Users\Admin\AppData\Local\Temp\6bc6b19a38122b926c4e3a5872283c56.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C "C:\Users\Admin\AppData\Roaming\u58w2\hqlbrd.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Roaming\u58w2\ast.exe
    "C:\Users\Admin\AppData\Roaming\u58w2\ast.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-153-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/696-150-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/696-156-0x0000000002920000-0x0000000002921000-memory.dmp

Download

memory/696-158-0x0000000002D30000-0x0000000002E00000-memory.dmp

Download

memory/696-160-0x0000000002D30000-0x0000000002E00000-memory.dmp

Download

memory/696-154-0x0000000002D60000-0x00000000040A8000-memory.dmp

Download

memory/696-171-0x0000000002D60000-0x00000000040A8000-memory.dmp

Download

memory/696-152-0x0000000002D30000-0x0000000002E00000-memory.dmp

Download

memory/696-155-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/696-151-0x00000000029A0000-0x00000000029A1000-memory.dmp

Download

memory/696-149-0x00000000029D0000-0x00000000029D1000-memory.dmp

Download

memory/696-166-0x0000000002D30000-0x0000000002E00000-memory.dmp

Download

memory/696-167-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/696-168-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/696-169-0x0000000002D30000-0x0000000002E00000-memory.dmp

Download

memory/696-148-0x0000000002950000-0x0000000002951000-memory.dmp

Download