Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
Resource
win10v2004-20240508-en
General
-
Target
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
-
Size
44KB
-
MD5
3466738a59b6a76f5dd7059760478764
-
SHA1
1a722af337ea07904be6bf25ac96dbce0ed20f47
-
SHA256
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3
-
SHA512
08465ad91792436e624fa970095c00e474562424458205a8a3a70279c559024f66b077b29f2b884ed9c7f50c3aca42a985fbf85febc864f15de6b9dd2f12bbfa
-
SSDEEP
768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvr9Vu18ys:RUNHFKQbIkHvGkA65p
Malware Config
Signatures
-
Processes:
rmass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
Processes:
rmass.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
rmass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
rmass.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
Processes:
rmass.exermass.exepid process 3316 rmass.exe 1752 rmass.exe -
Processes:
rmass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
rmass.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe -
Drops file in System32 directory 12 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exedescription ioc process File opened for modification C:\Windows\SysWOW64\rmass.exe da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File created C:\Windows\SysWOW64\rmass.exe da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rmass.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rmass.exermass.exepid process 3316 rmass.exe 3316 rmass.exe 3316 rmass.exe 3316 rmass.exe 3316 rmass.exe 3316 rmass.exe 1752 rmass.exe 1752 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exedescription pid process Token: SeDebugPrivilege 940 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe Token: SeDebugPrivilege 3316 rmass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exedescription pid process target process PID 940 wrote to memory of 3316 940 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 940 wrote to memory of 3316 940 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 940 wrote to memory of 3316 940 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 3316 wrote to memory of 612 3316 rmass.exe winlogon.exe PID 3316 wrote to memory of 3480 3316 rmass.exe Explorer.EXE PID 3316 wrote to memory of 1752 3316 rmass.exe rmass.exe PID 3316 wrote to memory of 1752 3316 rmass.exe rmass.exe PID 3316 wrote to memory of 1752 3316 rmass.exe rmass.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe"C:\Users\Admin\AppData\Local\Temp\da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\RECOVER32.DLLFilesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
C:\Windows\SysWOW64\ahuy.exeFilesize
46KB
MD5fd9d789f92e7f326371306638ba9152c
SHA17bc3435e7175f275e5a855fe5eefc8bdf7e57f0b
SHA256163610e3968046d63879e0ba259a15a22a889599b6d0b8efb71a0ed4ee89270c
SHA51213783b66e519c45a30c4c1b687ed350eae97107756661c627d5df6e596c376f02bbec30cd24f57755283e176a00cf2b53553fd86aa3fa9ad50706ca852ba12c0
-
C:\Windows\SysWOW64\ntdbg.exeFilesize
47KB
MD5ac8feddd608e20c40b73ec5dcd2180c1
SHA1299803230fa4187527e5c2cc51afeeb6561364e5
SHA25674c25a705975e277efcb64f75a76939bc89ff6638e29b7c4f77f258c8c34866e
SHA512dd85c5f2bbb43452fec19ac7efc39f7f14319fbae9c716c38c7e5d7b8761d01ea25590b62f5f1c962c8599e22f70e001cafc781c399b961668222dbe6e38e497
-
C:\Windows\SysWOW64\rmass.exeFilesize
44KB
MD53466738a59b6a76f5dd7059760478764
SHA11a722af337ea07904be6bf25ac96dbce0ed20f47
SHA256da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3
SHA51208465ad91792436e624fa970095c00e474562424458205a8a3a70279c559024f66b077b29f2b884ed9c7f50c3aca42a985fbf85febc864f15de6b9dd2f12bbfa
-
C:\Windows\System32\drivers\etc\hostsFilesize
1KB
MD56f47b62de25d1745e296a06b3f98ed19
SHA1a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
SHA25615c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
SHA512dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7
-
memory/940-5-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1752-50-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3316-49-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB