Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2024, 00:55
Behavioral task
behavioral1
Sample
5e8acf5ec31ff19535059327079314d7.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
General
- Target 5e8acf5ec31ff19535059327079314d7.exe
- Size 744KB
- Sample240116-a9yf6aahf2
- SHA256 43b05ba8653943e98321f3708dc7f24c6652eee6138725f6a41145d45679995c
- MD5 5e8acf5ec31ff19535059327079314d7
- SHA1 783e71eec65d29ead303e8f647918fb20675d354
- SHA512 4f168e4bae2edfa732f90d93c04931dbb0fe4a3fa7484c075906cd243489c9bd84c15eab2bd032a192c51e684f028e5171c972935c8160b545a6f72a50a7c0c2
- SSDEEP 12288:T8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixib:wUKoN0bUxgGa/pfBHDb+y1HgZo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latentbot
C2
-
rustyslaves.zapto.org
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\svchost.exe" 5e8acf5ec31ff19535059327079314d7.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 5e8acf5ec31ff19535059327079314d7.exe - Executes dropped EXE 1 IoCs
pid Process 3236 svchost.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\svchost.exe" 5e8acf5ec31ff19535059327079314d7.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3236 set thread context of 3060 3236 svchost.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5e8acf5ec31ff19535059327079314d7.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeSecurityPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeTakeOwnershipPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeLoadDriverPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeSystemProfilePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeSystemtimePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeProfSingleProcessPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeIncBasePriorityPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeCreatePagefilePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeBackupPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeRestorePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeShutdownPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeDebugPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeSystemEnvironmentPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeChangeNotifyPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeRemoteShutdownPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeUndockPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeManageVolumePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeImpersonatePrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeCreateGlobalPrivilege 3000 5e8acf5ec31ff19535059327079314d7.exe Token: 33 3000 5e8acf5ec31ff19535059327079314d7.exe Token: 34 3000 5e8acf5ec31ff19535059327079314d7.exe Token: 35 3000 5e8acf5ec31ff19535059327079314d7.exe Token: 36 3000 5e8acf5ec31ff19535059327079314d7.exe Token: SeIncreaseQuotaPrivilege 3236 svchost.exe Token: SeSecurityPrivilege 3236 svchost.exe Token: SeTakeOwnershipPrivilege 3236 svchost.exe Token: SeLoadDriverPrivilege 3236 svchost.exe Token: SeSystemProfilePrivilege 3236 svchost.exe Token: SeSystemtimePrivilege 3236 svchost.exe Token: SeProfSingleProcessPrivilege 3236 svchost.exe Token: SeIncBasePriorityPrivilege 3236 svchost.exe Token: SeCreatePagefilePrivilege 3236 svchost.exe Token: SeBackupPrivilege 3236 svchost.exe Token: SeRestorePrivilege 3236 svchost.exe Token: SeShutdownPrivilege 3236 svchost.exe Token: SeDebugPrivilege 3236 svchost.exe Token: SeSystemEnvironmentPrivilege 3236 svchost.exe Token: SeChangeNotifyPrivilege 3236 svchost.exe Token: SeRemoteShutdownPrivilege 3236 svchost.exe Token: SeUndockPrivilege 3236 svchost.exe Token: SeManageVolumePrivilege 3236 svchost.exe Token: SeImpersonatePrivilege 3236 svchost.exe Token: SeCreateGlobalPrivilege 3236 svchost.exe Token: 33 3236 svchost.exe Token: 34 3236 svchost.exe Token: 35 3236 svchost.exe Token: 36 3236 svchost.exe Token: SeIncreaseQuotaPrivilege 3060 iexplore.exe Token: SeSecurityPrivilege 3060 iexplore.exe Token: SeTakeOwnershipPrivilege 3060 iexplore.exe Token: SeLoadDriverPrivilege 3060 iexplore.exe Token: SeSystemProfilePrivilege 3060 iexplore.exe Token: SeSystemtimePrivilege 3060 iexplore.exe Token: SeProfSingleProcessPrivilege 3060 iexplore.exe Token: SeIncBasePriorityPrivilege 3060 iexplore.exe Token: SeCreatePagefilePrivilege 3060 iexplore.exe Token: SeBackupPrivilege 3060 iexplore.exe Token: SeRestorePrivilege 3060 iexplore.exe Token: SeShutdownPrivilege 3060 iexplore.exe Token: SeDebugPrivilege 3060 iexplore.exe Token: SeSystemEnvironmentPrivilege 3060 iexplore.exe Token: SeChangeNotifyPrivilege 3060 iexplore.exe Token: SeRemoteShutdownPrivilege 3060 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3060 iexplore.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3236 3000 5e8acf5ec31ff19535059327079314d7.exe 87 PID 3000 wrote to memory of 3236 3000 5e8acf5ec31ff19535059327079314d7.exe 87 PID 3000 wrote to memory of 3236 3000 5e8acf5ec31ff19535059327079314d7.exe 87 PID 3236 wrote to memory of 3060 3236 svchost.exe 88 PID 3236 wrote to memory of 3060 3236 svchost.exe 88 PID 3236 wrote to memory of 3060 3236 svchost.exe 88 PID 3236 wrote to memory of 3060 3236 svchost.exe 88 PID 3236 wrote to memory of 3060 3236 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e8acf5ec31ff19535059327079314d7.exe"C:\Users\Admin\AppData\Local\Temp\5e8acf5ec31ff19535059327079314d7.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Roaming\MSDCSC\svchost.exe"C:\Users\Admin\AppData\Roaming\MSDCSC\svchost.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\MSDCSC\svchost.exe
- Size 744KB
- SHA256 43b05ba8653943e98321f3708dc7f24c6652eee6138725f6a41145d45679995c
- MD5 5e8acf5ec31ff19535059327079314d7
- SHA1 783e71eec65d29ead303e8f647918fb20675d354
- SHA512 4f168e4bae2edfa732f90d93c04931dbb0fe4a3fa7484c075906cd243489c9bd84c15eab2bd032a192c51e684f028e5171c972935c8160b545a6f72a50a7c0c2
- SSDEEP 12288:T8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixib:wUKoN0bUxgGa/pfBHDb+y1HgZo
- MD5 SHA1 SHA512 SSDEEP