Analysis
-
max time kernel
1801s -
max time network
1805s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2023 17:49
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20231020-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10-20231023-en
windows10-1703-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Server.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
6ecaeda97e71ca06c16f1de261bde554
-
SHA1
03900cc265f0341aa2c46814166f03c15ed7575d
-
SHA256
f00081238b88a0a933dacc79d5406097918cc91454a6045a3b77cd47f825eea8
-
SHA512
fe81c0ca76f61f6afae805ffcb3e3c2b4c5e9a3554a1918b607a48e3535adb5ff1cd9d864a7d5666023cbac0a30458a57f809295789d2c48817646bae3077b8a
-
SSDEEP
768:3Y3D2QtCTpPchQRza90g5rxPXijj2TAuC4qu2XxrjEtCdnl2pi1Rz4Rk3hsGdpk3:S2CC9dzaGwrVJOzjEwzGi1dDxDkgS
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3612 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe Server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe Server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explower.exe Server.exe File opened for modification C:\Program Files (x86)\Explower.exe Server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe 3496 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3496 Server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe Token: SeIncBasePriorityPrivilege 3496 Server.exe Token: 33 3496 Server.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3496 wrote to memory of 3612 3496 Server.exe 89 PID 3496 wrote to memory of 3612 3496 Server.exe 89 PID 3496 wrote to memory of 3612 3496 Server.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:3612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD56ecaeda97e71ca06c16f1de261bde554
SHA103900cc265f0341aa2c46814166f03c15ed7575d
SHA256f00081238b88a0a933dacc79d5406097918cc91454a6045a3b77cd47f825eea8
SHA512fe81c0ca76f61f6afae805ffcb3e3c2b4c5e9a3554a1918b607a48e3535adb5ff1cd9d864a7d5666023cbac0a30458a57f809295789d2c48817646bae3077b8a