e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9

General

Target

e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Size

37KB
MD5

0393f4456944c13517e0c4429c44de98
SHA1

73f49870ddea933cea8928c8a9fd557629bf8ec7
SHA256

e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9
SHA512

f6787fac6f72ef008bd3ae3b40618176e03042998f8827c2c9c39afe0c0db3fbe8560183b9afdc624189e59a8708f1bae91a2f4e9234fc62cb796f84740075f5

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe

description	pid	process
Token: SeDebugPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: 33	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
Token: SeIncBasePriorityPrivilege	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe

description	pid	process	target process
PID 1172 wrote to memory of 2004	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe	netsh.exe
PID 1172 wrote to memory of 2004	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe	netsh.exe
PID 1172 wrote to memory of 2004	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe	netsh.exe
PID 1172 wrote to memory of 2004	1172	e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe
"C:\Users\Admin\AppData\Local\Temp\e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe" "e6ea815cb59c202855109ccdf758b1120d7a2f8b545abe39f0c6966ddacaa6f9.exe" ENABLE
2⤵
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/2004-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing