Analysis
- max time kernel
147s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
17/01/2024, 22:08
Behavioral task
behavioral1
Sample
63bc292efdfd2a38198c438a413ac023.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
- Target 63bc292efdfd2a38198c438a413ac023.exe
- Size 174KB
- Sample240117-12dpwsgbc7
- SHA256 5cdf20ea2b7defc40b573d8bf3fceda211d6f7e7d97cefd26f3ac210cbddb8af
- MD5 63bc292efdfd2a38198c438a413ac023
- SHA1 3887d692c1c070f3a45a35e10c29325b2c3283b6
- SHA512 75214d506bacbf1bbea6470efe4ce3ba69e24de757c563747a19209c898c0e92590f00934dd0ff1815e827f800b7351494ecf3e9d69bec9ac70c12fa9bb44daa
- SSDEEP 3072:YEjVHeXUTN4Ns1vJxrOL60AD85h3/Cz+ZYyXGdoyQdFKj3kCTN9SJC0ekT:YEjVLTONWJxrOLw85Z/7lDUjNj70ew
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latentbot
C2
-
sephiroth99.zapto.org
-
1sephiroth99.zapto.org
-
2sephiroth99.zapto.org
-
3sephiroth99.zapto.org
-
4sephiroth99.zapto.org
-
5sephiroth99.zapto.org
-
6sephiroth99.zapto.org
-
7sephiroth99.zapto.org
-
8sephiroth99.zapto.org
Signatures
- Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63bc292efdfd2a38198c438a413ac023.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\CCEGGQ6PE8.exe = "C:\\Users\\Admin\\AppData\\Roaming\\CCEGGQ6PE8.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
resource yara_rule behavioral2/memory/1404-0-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1404-4-0x0000000000400000-0x000000000047B000-memory.dmp upx - Modifies registry key 1 TTPs 4 IoCs
pid Process 4060 reg.exe 3656 reg.exe 4884 reg.exe 1044 reg.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1404 63bc292efdfd2a38198c438a413ac023.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeCreateTokenPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeAssignPrimaryTokenPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeLockMemoryPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeIncreaseQuotaPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeMachineAccountPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeTcbPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeSecurityPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeTakeOwnershipPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeLoadDriverPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeSystemProfilePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeSystemtimePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeProfSingleProcessPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeIncBasePriorityPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeCreatePagefilePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeCreatePermanentPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeBackupPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeRestorePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeShutdownPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeDebugPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeAuditPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeSystemEnvironmentPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeChangeNotifyPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeRemoteShutdownPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeUndockPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeSyncAgentPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeEnableDelegationPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeManageVolumePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeImpersonatePrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: SeCreateGlobalPrivilege 1404 63bc292efdfd2a38198c438a413ac023.exe Token: 31 1404 63bc292efdfd2a38198c438a413ac023.exe Token: 32 1404 63bc292efdfd2a38198c438a413ac023.exe Token: 33 1404 63bc292efdfd2a38198c438a413ac023.exe Token: 34 1404 63bc292efdfd2a38198c438a413ac023.exe Token: 35 1404 63bc292efdfd2a38198c438a413ac023.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1404 63bc292efdfd2a38198c438a413ac023.exe 1404 63bc292efdfd2a38198c438a413ac023.exe 1404 63bc292efdfd2a38198c438a413ac023.exe 1404 63bc292efdfd2a38198c438a413ac023.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1404 wrote to memory of 4928 1404 63bc292efdfd2a38198c438a413ac023.exe 88 PID 1404 wrote to memory of 4928 1404 63bc292efdfd2a38198c438a413ac023.exe 88 PID 1404 wrote to memory of 4928 1404 63bc292efdfd2a38198c438a413ac023.exe 88 PID 1404 wrote to memory of 2680 1404 63bc292efdfd2a38198c438a413ac023.exe 95 PID 1404 wrote to memory of 2680 1404 63bc292efdfd2a38198c438a413ac023.exe 95 PID 1404 wrote to memory of 2680 1404 63bc292efdfd2a38198c438a413ac023.exe 95 PID 1404 wrote to memory of 1824 1404 63bc292efdfd2a38198c438a413ac023.exe 90 PID 1404 wrote to memory of 1824 1404 63bc292efdfd2a38198c438a413ac023.exe 90 PID 1404 wrote to memory of 1824 1404 63bc292efdfd2a38198c438a413ac023.exe 90 PID 1404 wrote to memory of 184 1404 63bc292efdfd2a38198c438a413ac023.exe 89 PID 1404 wrote to memory of 184 1404 63bc292efdfd2a38198c438a413ac023.exe 89 PID 1404 wrote to memory of 184 1404 63bc292efdfd2a38198c438a413ac023.exe 89 PID 1824 wrote to memory of 4060 1824 cmd.exe 96 PID 1824 wrote to memory of 4060 1824 cmd.exe 96 PID 1824 wrote to memory of 4060 1824 cmd.exe 96 PID 2680 wrote to memory of 3656 2680 cmd.exe 97 PID 2680 wrote to memory of 3656 2680 cmd.exe 97 PID 2680 wrote to memory of 3656 2680 cmd.exe 97 PID 4928 wrote to memory of 4884 4928 cmd.exe 98 PID 4928 wrote to memory of 4884 4928 cmd.exe 98 PID 4928 wrote to memory of 4884 4928 cmd.exe 98 PID 184 wrote to memory of 1044 184 cmd.exe 99 PID 184 wrote to memory of 1044 184 cmd.exe 99 PID 184 wrote to memory of 1044 184 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe"C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\CCEGGQ6PE8.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CCEGGQ6PE8.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\CCEGGQ6PE8.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CCEGGQ6PE8.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4060
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\63bc292efdfd2a38198c438a413ac023.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3656
-
-