412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378

General

Target

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Size

93KB
MD5

41b4d68e419abf8af4cc3006703dfb98
SHA1

18d4e9730b390eeb05b6aeba1e7fce83426c55d0
SHA256

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378
SHA512

52f7f05999ec3f294c8631d82ab458125c74b52ac00e7c5318cf47f76e3b7a26bebd7baa327030bbd9976815c3b7f9806e35713af8f56d20d8be303e5843fd9d
SSDEEP

1536:IxwC+xhUa9urgOBPRNvM4jEwzGi1dDOD+gS:IxmUa9urgObdGi1dIj

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2304 netsh.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

32 0.tcp.eu.ngrok.io
56 0.tcp.eu.ngrok.io
2 0.tcp.eu.ngrok.io
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

pid process

2284 412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

pid	process
2304	netsh.exe

flow	ioc
32	0.tcp.eu.ngrok.io
56	0.tcp.eu.ngrok.io
2	0.tcp.eu.ngrok.io

pid	process
2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

description	pid	process
Token: SeDebugPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: 33	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Token: SeIncBasePriorityPrivilege	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe

description	pid	process	target process
PID 2284 wrote to memory of 2304	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe	netsh.exe
PID 2284 wrote to memory of 2304	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe	netsh.exe
PID 2284 wrote to memory of 2304	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe	netsh.exe
PID 2284 wrote to memory of 2304	2284	412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
"C:\Users\Admin\AppData\Local\Temp\412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe" "412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-0-0x0000000074411000-0x0000000074412000-memory.dmp

Filesize
4KB

Download
memory/2284-2-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-1-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-4-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing