67a9a20ffb574a91a7b7c33e07cd956d3e86ddc42cea10b7bdffeac6ca87a7c4

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-08-2022 23:08

Target

bElO.exe
Size

23KB
MD5

a83a2e899e6556b71b660e14f193a53c
SHA1

65988cc2c1932355efb667896158a16ccf40ab1b
SHA256

67a9a20ffb574a91a7b7c33e07cd956d3e86ddc42cea10b7bdffeac6ca87a7c4
SHA512

dc6ae0a14e6268a1ce0903a22f093119204076048b5d10efed6cf044c9c0cb7e841894fffdbf226913013fbfa5762c480cd8c38ca7ea0882f0257e7c0135df71

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1876 netsh.exe

pid	process
1876	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

bElO.exe

description	pid	process
Token: SeDebugPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe
Token: 33	828	bElO.exe
Token: SeIncBasePriorityPrivilege	828	bElO.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bElO.exe

description	pid	process	target process
PID 828 wrote to memory of 1876	828	bElO.exe	netsh.exe
PID 828 wrote to memory of 1876	828	bElO.exe	netsh.exe
PID 828 wrote to memory of 1876	828	bElO.exe	netsh.exe
PID 828 wrote to memory of 1876	828	bElO.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bElO.exe" "bElO.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1876

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/828-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/828-55-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/828-58-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1876-56-0x0000000000000000-mapping.dmp

Download