Resubmissions
23-02-2023 14:03
230223-rcnzwsga69 1020-01-2023 12:25
230120-plqhzaff6y 1016-01-2023 12:00
230116-n6kyjsad9v 1015-01-2023 04:12
230115-esqr7sdg4v 1015-01-2023 04:01
230115-elc8jahg27 815-01-2023 03:56
230115-ehjk5shf75 815-01-2023 01:02
230115-bebjksbg8w 1015-01-2023 00:38
230115-azcfyafg72 8Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2023 14:03
Static task
static1
Behavioral task
behavioral1
Sample
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe
Resource
win7-20230220-en
General
-
Target
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe
-
Size
1.6MB
-
MD5
9f7aaf3a9a3f325dd533ecc38d85a351
-
SHA1
1ebdc55b96e11d9b924fbba8c5fa1799ff247970
-
SHA256
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd
-
SHA512
0afdcb5362be67938d00baaeb3974af3ad2b7342c8024ec2390ce87bad4c6252e4c8277a0bb36979cdcb4036aa9f7dc93ac23f78acdd04033c3086fa3fd7286f
-
SSDEEP
24576:yWmAFubS9dt9Mcp5CPu4YV5GaCxYiluVuTY4PRVGEw6GPDp5MwNrsJjF2GKGI8L:q29dRpYW4YV5QxYiET8ahPDMwNrs2y
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4684-218-0x0000000000500000-0x00000000005A6000-memory.dmp family_sectoprat -
Executes dropped EXE 2 IoCs
Processes:
Engine.exeChampion.exe.pifpid process 4776 Engine.exe 1260 Champion.exe.pif -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe upx C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe upx behavioral2/memory/4776-145-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4776-200-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4776-212-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4776-213-0x0000000000400000-0x0000000000558000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Champion.exe.pifdescription pid process target process PID 1260 set thread context of 4684 1260 Champion.exe.pif jsc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{AD5DCDC9-D395-4B80-BEF6-62593B2D8D30} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{B7B76695-039C-438D-AC9D-16A072B42724} svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exeChampion.exe.pifpid process 2404 powershell.exe 2404 powershell.exe 2404 powershell.exe 2456 powershell.exe 2456 powershell.exe 2456 powershell.exe 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exejsc.exedescription pid process Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 4684 jsc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Champion.exe.pifpid process 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Champion.exe.pifpid process 1260 Champion.exe.pif 1260 Champion.exe.pif 1260 Champion.exe.pif -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1072 OpenWith.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exeEngine.execmd.execmd.exeChampion.exe.pifdescription pid process target process PID 1896 wrote to memory of 4776 1896 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 1896 wrote to memory of 4776 1896 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 1896 wrote to memory of 4776 1896 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 4776 wrote to memory of 3128 4776 Engine.exe cmd.exe PID 4776 wrote to memory of 3128 4776 Engine.exe cmd.exe PID 4776 wrote to memory of 3128 4776 Engine.exe cmd.exe PID 3128 wrote to memory of 4596 3128 cmd.exe cmd.exe PID 3128 wrote to memory of 4596 3128 cmd.exe cmd.exe PID 3128 wrote to memory of 4596 3128 cmd.exe cmd.exe PID 4596 wrote to memory of 2404 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 2404 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 2404 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 2456 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 2456 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 2456 4596 cmd.exe powershell.exe PID 4596 wrote to memory of 1928 4596 cmd.exe findstr.exe PID 4596 wrote to memory of 1928 4596 cmd.exe findstr.exe PID 4596 wrote to memory of 1928 4596 cmd.exe findstr.exe PID 4596 wrote to memory of 1260 4596 cmd.exe Champion.exe.pif PID 4596 wrote to memory of 1260 4596 cmd.exe Champion.exe.pif PID 4596 wrote to memory of 1260 4596 cmd.exe Champion.exe.pif PID 4596 wrote to memory of 1224 4596 cmd.exe PING.EXE PID 4596 wrote to memory of 1224 4596 cmd.exe PING.EXE PID 4596 wrote to memory of 1224 4596 cmd.exe PING.EXE PID 1260 wrote to memory of 4684 1260 Champion.exe.pif jsc.exe PID 1260 wrote to memory of 4684 1260 Champion.exe.pif jsc.exe PID 1260 wrote to memory of 4684 1260 Champion.exe.pif jsc.exe PID 1260 wrote to memory of 4684 1260 Champion.exe.pif jsc.exe PID 1260 wrote to memory of 4684 1260 Champion.exe.pif jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe /TH_ID=_3028 /OriginExe="C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd < 43⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ibXEdmiVmigethPmiCeveAlmmdbbRGVlGZgkrkVHBRdIphNCcvDTejGGhntqwKrSktcyZDvWGxUklCdjCVwceeizaHYEiVGRNbvySICSZHhIac$" 455⤵
-
C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\25850\Champion.exe.pif25850\\Champion.exe.pif 25850\\S5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 185⤵
- Runs ping.exe
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD58fffa9f05ef338deefff0625687db232
SHA1d217b1668f0b21492e462f1fdeea05c1cad5fc65
SHA256075d0fdc2fe8d8f118c3b7fa44da197a7cbe7dc125cf91a8f65b89a20fea0702
SHA512c001840264e9693a6cd799d40f49d11c5833043bfc4b7bde25a5c4ead520afc22f13829ff65c006be75a6db8c9af88f6770e75f5e5f488fc87e831fd36e1f56e
-
C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\25850\Champion.exe.pifFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00000#4Filesize
12KB
MD54839bb17c0c82a044dbd0072c6c98cb6
SHA13c06dcc178dd8a8e2290b746cfc7e704a537c91f
SHA256a7e6636cd2ba510513484cfea9201884f64f7b664951402b909caf9728704ec2
SHA51213d607b989efca3105363a10f481ef02fdcfcd5da4a267da0b87f3f2417456e672337c8e6332e0be286f6401bea203149a1cd23a24a8006f689b32e9d6199b55
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00001#45Filesize
872KB
MD5a3b85111ecdfc29672319893192bb7fd
SHA14ec865fd387eade4cd0b0ad8cabd68cae89ac8d5
SHA256ec8149d7c157e53108c089f07b8d2bf1156b8c1f8632c938a2130279927e2367
SHA5120c9e75843ebe962246a0fd2d15e2b90ae71257aac15ee7b1cf12a3fc383a144fef5959c0a81c7d9f55ef6893937b1a9868a7c2546d70045c40810a7b3a0be804
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00002#7Filesize
1.5MB
MD5536073c3748e4eb7bbee303547b7227d
SHA14397b1d855e799f4d38467a848cda2273c1c6c73
SHA2568e289b8dfc7e4994d808ef79a88adb513365177604fe587f6efa812f284e21a3
SHA5123b1e1c853c362770a4ddcc4c7b3b932f9adf9db006bf649266a1b0c9c6c7b0afb7f0cd5687f672ed58908c9af8b56a830888b6f30defb97297cbde8de18f7651
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exeFilesize
392KB
MD5a7a99a201774531d761f6aac2651a9df
SHA1b122ae368c4bf103e959a6ebb54ddb310117ab96
SHA256e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524
SHA512056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exeFilesize
392KB
MD5a7a99a201774531d761f6aac2651a9df
SHA1b122ae368c4bf103e959a6ebb54ddb310117ab96
SHA256e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524
SHA512056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Modern_Icon.bmpFilesize
7KB
MD51dd88f67f029710d5c5858a6293a93f1
SHA13e5ef66613415fe9467b2a24ccc27d8f997e7df6
SHA256b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532
SHA5127071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Setup.txtFilesize
2KB
MD5ae90fca8c12f2c43c468fbd0954381f7
SHA1d475bb8f5891ab5f4c7cd2c90847cbfa68758842
SHA256d9f67a975a877aa95e76821542311adb21704988d8452916d5b51feeeff3e720
SHA5126880c7b658b7852bfcd597a57fd6e85f8a218e18d7acc248edc8efb2bea5a61063c4eeb5ae48008cc07408501c1af0eefc6a9010820ba823ab3fe66dae1f9041
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kijmp54y.fog.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Videos\Captures\desktop.iniFilesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
C:\Users\Admin\Videos\Captures\desktop.iniFilesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
memory/1260-217-0x0000000001110000-0x0000000001111000-memory.dmpFilesize
4KB
-
memory/1896-181-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1896-216-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2404-184-0x0000000006D80000-0x0000000006D9A000-memory.dmpFilesize
104KB
-
memory/2404-165-0x00000000052C0000-0x00000000052F6000-memory.dmpFilesize
216KB
-
memory/2404-169-0x00000000058F0000-0x0000000005912000-memory.dmpFilesize
136KB
-
memory/2404-182-0x0000000006890000-0x00000000068AE000-memory.dmpFilesize
120KB
-
memory/2404-183-0x0000000007850000-0x00000000078E6000-memory.dmpFilesize
600KB
-
memory/2404-170-0x00000000061D0000-0x0000000006236000-memory.dmpFilesize
408KB
-
memory/2404-185-0x0000000006E00000-0x0000000006E22000-memory.dmpFilesize
136KB
-
memory/2404-186-0x0000000007EA0000-0x0000000008444000-memory.dmpFilesize
5.6MB
-
memory/2404-167-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/2404-168-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/2404-176-0x0000000006240000-0x00000000062A6000-memory.dmpFilesize
408KB
-
memory/2404-166-0x0000000005A30000-0x0000000006058000-memory.dmpFilesize
6.2MB
-
memory/2456-202-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4684-222-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4684-218-0x0000000000500000-0x00000000005A6000-memory.dmpFilesize
664KB
-
memory/4684-220-0x0000000004B60000-0x0000000004BF2000-memory.dmpFilesize
584KB
-
memory/4684-221-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4776-146-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/4776-212-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4776-213-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4776-200-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4776-145-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4776-201-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB