Analysis

  • max time kernel
    132s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2023 18:35

General

  • Target

    Magicratbggdhgejff1_browsingExe.exe

  • Size

    18.5MB

  • MD5

    b4c9b903dfd18bd67a3824b0109f955b

  • SHA1

    a3555a77826df6c8b2886cc0f40e7d7a2bd99610

  • SHA256

    f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332

  • SHA512

    73ec5620b9c607c96e883d95ac6ea4033444cb74def871d16875bb90cdf6560e592c1dcb9d6e9b406cd7d238464f46f61ca5f95bf07b0367ee826971ff151aed

  • SSDEEP

    196608:99rTfn5Mp6Z9j2ujTh4e9q77AJsv6tWKFdu9CqK:9F+p6Z3Ph4e9qoJsv6tWKFdu9C

Score
10/10

Malware Config

Signatures

  • Detected MagicRAT payload 7 IoCs
  • magicrat

    MagicRAT is a remote access trojan developed and operated by the Lazarus APT group.

  • Drops file in System32 directory 5 IoCs
  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Magicratbggdhgejff1_browsingExe.exe
    "C:\Users\Admin\AppData\Local\Temp\Magicratbggdhgejff1_browsingExe.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:556
      • C:\Windows\system32\bcdedit.exe
        bcdedit
        3⤵
          PID:3004
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c schtasks /create /tn "OneDrive AutoRemove" /tr "C:\Windows\System32\cmd.exe /c del /f /q C:/Users/Admin/AppData/Local/Temp/Magicratbggdhgejff1_browsingExe.exe" /sc daily /st 10:30:30 /ru SYSTEM
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "OneDrive AutoRemove" /tr "C:\Windows\System32\cmd.exe /c del /f /q C:/Users/Admin/AppData/Local/Temp/Magicratbggdhgejff1_browsingExe.exe" /sc daily /st 10:30:30 /ru SYSTEM
          3⤵
          • Creates scheduled task(s)
          PID:800
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c schtasks /delete /f /tn "Microsoft\Windows\light Service Manager"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /f /tn "Microsoft\Windows\light Service Manager"
          3⤵
            PID:1820
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c bcdedit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\system32\bcdedit.exe
            bcdedit
            3⤵
              PID:4540
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c schtasks /create /tn "Microsoft\Windows\light Service Manager" /tr C:/Users/Admin/AppData/Local/Temp/Magicratbggdhgejff1_browsingExe.exe /sc onstart /ru SYSTEM
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1648
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\light Service Manager" /tr C:/Users/Admin/AppData/Local/Temp/Magicratbggdhgejff1_browsingExe.exe /sc onstart /ru SYSTEM
              3⤵
              • Creates scheduled task(s)
              PID:4316
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3924 -s 1232
            2⤵
            • Program crash
            PID:4808
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3812 -s 3012
          1⤵
          • Program crash
          PID:3540
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 496 -p 320 -ip 320
          1⤵
            PID:4924
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 508 -p 4744 -ip 4744
            1⤵
              PID:324
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 320 -s 3088
              1⤵
              • Program crash
              PID:3532
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4744 -s 716
              1⤵
              • Program crash
              PID:3464
            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
              1⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of SetWindowsHookEx
              PID:3520
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 584 -p 320 -ip 320
              1⤵
                PID:4696
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 320 -s 3168
                1⤵
                • Program crash
                PID:2776
              • C:\Windows\system32\dwm.exe
                "dwm.exe"
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4956

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/3924-138-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-139-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-142-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-146-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-147-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-148-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB

              • memory/3924-149-0x0000000000400000-0x000000000167E000-memory.dmp

                Filesize

                18.5MB