53924ec04fd027a17ceec00ef3d0e77637a8c372b2ee1b6095bf1ee4cf288fc4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bNkn.exe
Size

23KB
MD5

18f1c4c76bfa3e98a97628f741361a50
SHA1

b996ca964b34339725b02abfc9b6b0fcbe5628d8
SHA256

53924ec04fd027a17ceec00ef3d0e77637a8c372b2ee1b6095bf1ee4cf288fc4
SHA512

0da74271f186591c338db5b301deff1f7b15f3373ec725d67dcb1dc0ce1ee36d75ef12002d430980ff1001b0a0457149388c31591dabef33917f3de893035637
SSDEEP

384:xhc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZXd:xTe9EJLN/yRpcnua

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2004 netsh.exe

pid	process
2004	netsh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bNkn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\8281218078858e75d74a07bde6e8bc62 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bNkn.exe\" .."	bNkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8281218078858e75d74a07bde6e8bc62 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bNkn.exe\" .."	bNkn.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

bNkn.exe

description	pid	process
Token: SeDebugPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe
Token: 33	2040	bNkn.exe
Token: SeIncBasePriorityPrivilege	2040	bNkn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bNkn.exe

description	pid	process	target process
PID 2040 wrote to memory of 2004	2040	bNkn.exe	netsh.exe
PID 2040 wrote to memory of 2004	2040	bNkn.exe	netsh.exe
PID 2040 wrote to memory of 2004	2040	bNkn.exe	netsh.exe
PID 2040 wrote to memory of 2004	2040	bNkn.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\bNkn.exe
"C:\Users\Admin\AppData\Local\Temp\bNkn.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bNkn.exe" "bNkn.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/2040-55-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/2040-56-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/2040-57-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download