be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

Resubmissions

18/10/2022, 04:32

221018-e51g6seeb810

18/10/2022, 04:06

221018-epj59aedd67

18/10/2022, 03:34

221018-d417mseefj10

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Size 521KB
Sample221018-epj59aedd6
SHA256 be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b
MD5 c0318aa61a314fed79c87be28f0db3ba
SHA1 361e5206d2e0aeb88174c524e6c7cfb90c94670d
SHA512 619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586
SSDEEP 12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1104	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SvcManager\svcmgr.exe	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
760	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	powershell.exe
1972	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1788	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	28
PID 532 wrote to memory of 1788	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	28
PID 532 wrote to memory of 1788	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	28
PID 532 wrote to memory of 1788	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	28
PID 1788 wrote to memory of 732	1788	cmd.exe	29
PID 1788 wrote to memory of 732	1788	cmd.exe	29
PID 1788 wrote to memory of 732	1788	cmd.exe	29
PID 1788 wrote to memory of 732	1788	cmd.exe	29
PID 732 wrote to memory of 1528	732	net.exe	30
PID 732 wrote to memory of 1528	732	net.exe	30
PID 732 wrote to memory of 1528	732	net.exe	30
PID 732 wrote to memory of 1528	732	net.exe	30
PID 532 wrote to memory of 936	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	31
PID 532 wrote to memory of 936	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	31
PID 532 wrote to memory of 936	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	31
PID 532 wrote to memory of 936	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	31
PID 936 wrote to memory of 2032	936	cmd.exe	32
PID 936 wrote to memory of 2032	936	cmd.exe	32
PID 936 wrote to memory of 2032	936	cmd.exe	32
PID 936 wrote to memory of 2032	936	cmd.exe	32
PID 532 wrote to memory of 2012	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	33
PID 532 wrote to memory of 2012	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	33
PID 532 wrote to memory of 2012	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	33
PID 532 wrote to memory of 2012	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	33
PID 2012 wrote to memory of 1972	2012	cmd.exe	34
PID 2012 wrote to memory of 1972	2012	cmd.exe	34
PID 2012 wrote to memory of 1972	2012	cmd.exe	34
PID 2012 wrote to memory of 1972	2012	cmd.exe	34
PID 532 wrote to memory of 364	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	35
PID 532 wrote to memory of 364	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	35
PID 532 wrote to memory of 364	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	35
PID 532 wrote to memory of 364	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	35
PID 532 wrote to memory of 1104	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 532 wrote to memory of 1104	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 532 wrote to memory of 1104	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 532 wrote to memory of 1104	532	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 1104 wrote to memory of 760	1104	cmd.exe	38
PID 1104 wrote to memory of 760	1104	cmd.exe	38
PID 1104 wrote to memory of 760	1104	cmd.exe	38
PID 1104 wrote to memory of 760	1104	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
"C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user %username%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\net.exe
    net user Admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin
      4⤵
      PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Set-ExecutionPolicy bypass -Force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Set-ExecutionPolicy bypass -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q C:\Windows\SvcManager
  2⤵
  PID:364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 811fceb70aeb1640f6ecfa79035fcb83e258abbc4d900991445f1b8019cfc7e2
MD5 3391cf64facc7c7d4b1047d6952699c0
SHA1 ffa1ebc9aec5475094c44899d012492cc89c4223
SHA512 165ca547edb15b7210e4822ffb39dde5da902d50f527c687d530f91c1d3b7d28602bafa5ee14e41878d8decca228a06b47ffe72459d348e1f2d7d71bd8e7de5a
SSDEEP 96:chmxCNM8CnqvsqvJCwod51hmxCNM8CnqvsEHyqvJCwor/5zLUxQHx67gVXlUVScC:EruUo/ruAHnorpqc67gVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-74-0x0000000000308000-0x0000000000365000-memory.dmp

Download

memory/532-71-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/532-76-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/532-70-0x0000000000308000-0x0000000000365000-memory.dmp

Download

memory/532-61-0x0000000000308000-0x0000000000365000-memory.dmp

Download

memory/532-62-0x0000000001E10000-0x0000000001EB1000-memory.dmp

Download

memory/532-63-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/532-54-0x0000000000308000-0x0000000000365000-memory.dmp

Download

memory/1972-69-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2032-66-0x0000000073810000-0x0000000073DBB000-memory.dmp

Download

memory/2032-60-0x0000000075091000-0x0000000075093000-memory.dmp

Download