Analysis
-
max time kernel
320s -
max time network
327s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 05:18
Static task
static1
Behavioral task
behavioral1
Sample
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe
Resource
win10-20220812-en
General
-
Target
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe
-
Size
700.4MB
-
MD5
96319a877bcdee0b4788a88b69b1f215
-
SHA1
6e1645c605965b20fab6775c0b676401cbbff00d
-
SHA256
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55
-
SHA512
b2fcfe7a1a75b24323ba0ff96821c1561932f0c06136c4100b05eddfd667f9aecf6d488eed12c8cda52c2d9789d9120a24b7e16fc90b2c75d521563211c302c8
-
SSDEEP
6144:/EopXhSxHralFw1nXEjb5QM0Pq5Ml2QOyAm2c84fHNArD7V/2c84fH:2rkSnXEjupPa1QdAm2lgNCDx/2lg
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\nvmcache\\raadmin.exe," reg.exe -
Executes dropped EXE 1 IoCs
Processes:
raadmin.exepid process 1648 raadmin.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 4560 PING.EXE 4844 PING.EXE 4632 PING.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exepid process 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exeraadmin.exedescription pid process Token: SeDebugPrivilege 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe Token: SeDebugPrivilege 1648 raadmin.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.execmd.execmd.exedescription pid process target process PID 4668 wrote to memory of 428 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 4668 wrote to memory of 428 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 4668 wrote to memory of 428 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 428 wrote to memory of 4560 428 cmd.exe PING.EXE PID 428 wrote to memory of 4560 428 cmd.exe PING.EXE PID 428 wrote to memory of 4560 428 cmd.exe PING.EXE PID 4668 wrote to memory of 3148 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 4668 wrote to memory of 3148 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 4668 wrote to memory of 3148 4668 22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe cmd.exe PID 3148 wrote to memory of 4844 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 4844 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 4844 3148 cmd.exe PING.EXE PID 428 wrote to memory of 4248 428 cmd.exe reg.exe PID 428 wrote to memory of 4248 428 cmd.exe reg.exe PID 428 wrote to memory of 4248 428 cmd.exe reg.exe PID 3148 wrote to memory of 4632 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 4632 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 4632 3148 cmd.exe PING.EXE PID 3148 wrote to memory of 1648 3148 cmd.exe raadmin.exe PID 3148 wrote to memory of 1648 3148 cmd.exe raadmin.exe PID 3148 wrote to memory of 1648 3148 cmd.exe raadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe"C:\Users\Admin\AppData\Local\Temp\22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 58 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe,"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 583⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe,"3⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 68 > nul && copy "C:\Users\Admin\AppData\Local\Temp\22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55.exe" "C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe" && ping 127.0.0.1 -n 68 > nul && "C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 683⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 683⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe"C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exeFilesize
700.4MB
MD596319a877bcdee0b4788a88b69b1f215
SHA16e1645c605965b20fab6775c0b676401cbbff00d
SHA25622ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55
SHA512b2fcfe7a1a75b24323ba0ff96821c1561932f0c06136c4100b05eddfd667f9aecf6d488eed12c8cda52c2d9789d9120a24b7e16fc90b2c75d521563211c302c8
-
C:\Users\Admin\AppData\Roaming\nvmcache\raadmin.exeFilesize
700.4MB
MD596319a877bcdee0b4788a88b69b1f215
SHA16e1645c605965b20fab6775c0b676401cbbff00d
SHA25622ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55
SHA512b2fcfe7a1a75b24323ba0ff96821c1561932f0c06136c4100b05eddfd667f9aecf6d488eed12c8cda52c2d9789d9120a24b7e16fc90b2c75d521563211c302c8
-
memory/428-207-0x0000000000000000-mapping.dmp
-
memory/1648-346-0x00000000010C0000-0x0000000001144000-memory.dmpFilesize
528KB
-
memory/1648-309-0x0000000000000000-mapping.dmp
-
memory/3148-233-0x0000000000000000-mapping.dmp
-
memory/4248-262-0x0000000000000000-mapping.dmp
-
memory/4560-214-0x0000000000000000-mapping.dmp
-
memory/4632-286-0x0000000000000000-mapping.dmp
-
memory/4668-151-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-125-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-122-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-123-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-154-0x0000000005080000-0x000000000557E000-memory.dmpFilesize
5.0MB
-
memory/4668-155-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-126-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-127-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-128-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-129-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-130-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-131-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-132-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-133-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-134-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-135-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-136-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-137-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-138-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-139-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-140-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-141-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-142-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-143-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-144-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-145-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-146-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-147-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-149-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-148-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-150-0x0000000001120000-0x00000000011A4000-memory.dmpFilesize
528KB
-
memory/4668-120-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-152-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-153-0x00000000049F0000-0x0000000004A8C000-memory.dmpFilesize
624KB
-
memory/4668-156-0x0000000004A90000-0x0000000004B22000-memory.dmpFilesize
584KB
-
memory/4668-121-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-124-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-157-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-158-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-159-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-160-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-161-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-162-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-163-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-164-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-165-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-166-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-167-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-168-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-169-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-170-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-171-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-172-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-173-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-174-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-175-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-176-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-177-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-178-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-179-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-180-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-181-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-182-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-183-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-198-0x0000000005A40000-0x0000000005A70000-memory.dmpFilesize
192KB
-
memory/4668-201-0x0000000005C60000-0x0000000005C6A000-memory.dmpFilesize
40KB
-
memory/4668-119-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-118-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-117-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-116-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4668-205-0x0000000007A80000-0x0000000007A98000-memory.dmpFilesize
96KB
-
memory/4844-240-0x0000000000000000-mapping.dmp