Analysis
-
max time kernel
600s -
max time network
603s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 05:32
Static task
static1
Behavioral task
behavioral1
Sample
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe
Resource
win7-20220812-en
General
-
Target
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe
-
Size
292KB
-
MD5
0bb8cd8c15d83ecf1691797cec23e5f0
-
SHA1
3166b77481b08d270bd8cb1c432bd67398f8a1e2
-
SHA256
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9
-
SHA512
d7651e3d585e3c4766682576b7ee89c81a29f9e0adaa1aa97af9b1a7e778b629812d84a8ce2793f4d8622d1f728dcf505e65c55e63f514f9e395ff695f483e0b
-
SSDEEP
6144:RyBK8GMRovbL43fPf6jXdmFDYoCCcUrHX4OKCwEo6v:UDTovP43nfemFWUrHX4OXwd6v
Malware Config
Extracted
ramnit
28
malesaqua.eu:442
-
campaign_timestamp
1.506273416e+09
-
compile_timestamp
1.505999145e+09
-
dga_seed
4.13789472e+09
-
listen_port
0
-
num_dga_domains
100
Extracted
ramnit
��1
malesaqua.eu:442
-
campaign_timestamp
1.506273416e+09
-
compile_timestamp
1.505999145e+09
-
dga_seed
4.13789472e+09
-
listen_port
0
-
num_dga_domains
100
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
wmplayer.exepid process 3300 wmplayer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qohmjlgr = "C:\\Users\\Admin\\AppData\\Roaming\\qohmjlgr\\gxgrrged.vbs" WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exedescription pid process target process PID 3080 set thread context of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 set thread context of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe -
Modifies registry class 1 IoCs
Processes:
wmplayer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings wmplayer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wmplayer.exepid process 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe 3300 wmplayer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exepid process 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exewmplayer.exedescription pid process Token: SeDebugPrivilege 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe Token: SeSecurityPrivilege 3300 wmplayer.exe Token: SeDebugPrivilege 3300 wmplayer.exe Token: SeRestorePrivilege 3300 wmplayer.exe Token: SeBackupPrivilege 3300 wmplayer.exe Token: SeDebugPrivilege 3300 wmplayer.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exewmplayer.exedescription pid process target process PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3080 wrote to memory of 3300 3080 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 3300 wrote to memory of 4392 3300 wmplayer.exe WScript.exe PID 3300 wrote to memory of 4392 3300 wmplayer.exe WScript.exe PID 3300 wrote to memory of 4392 3300 wmplayer.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe"C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\qohmjlgr\nhnhpbsu.vbs"3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~TM2B17.tmpFilesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
C:\Users\Admin\AppData\Roaming\qohmjlgr\nhnhpbsu.vbsFilesize
193B
MD54ccb92ac4c5f6063ade6a9808efd01fb
SHA12c7ee1d8f13e8886cdc5676e74c244df3294005e
SHA256efb0241e07e165b7627c4d3832fc761fd941bcb871d689bdbd9b3db0eb28266d
SHA5128f89d8663c8293e1805e59e28f950152decfb773d5f9a1a2db54232f45339e2f26795f112deec2a2ace72a1818a6e85a5154db6146724bf4a4c67028e4f83b65
-
memory/3080-132-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/3080-136-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/3300-133-0x0000000000000000-mapping.dmp
-
memory/3300-134-0x00000000013A0000-0x00000000013A0318-memory.dmpFilesize
792B
-
memory/3300-135-0x0000000002EB0000-0x0000000002EF1000-memory.dmpFilesize
260KB
-
memory/3300-138-0x0000000002EB0000-0x0000000002EF1000-memory.dmpFilesize
260KB
-
memory/4392-139-0x0000000000000000-mapping.dmp