Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 01:58
Behavioral task
behavioral1
Sample
b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe
- Size 63KB
- Sample240530-cd4peabd78
- SHA256 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f
- MD5 1d0f03c689152c033ececf8006e57bf1
- SHA1 f194025249c66a00b52db8a7f817a938b4ea335a
- SHA512 9d71e688c73dce6d3c069850bc7174ed2968eed7407541a1972ffdc91c5cf65a0bc66bbf52638d97d44754904cb382ddd7a8349c0c40006df8e139bfca130051
- SSDEEP 768:rAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGKQLddOW/g4WvU+oQ:sUNHFKQbIkHvGMdO74k
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe - Executes dropped EXE 2 IoCs
pid Process 3876 rmass.exe 1064 rmass.exe -
resource yara_rule behavioral2/memory/3052-0-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/3052-12-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/3876-7-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/files/0x0009000000022912-6.dat upx behavioral2/memory/1064-18-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/3876-52-0x0000000000400000-0x0000000000412000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File created C:\Windows\SysWOW64\rmass.exe b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 1064 rmass.exe 1064 rmass.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3052 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe Token: SeDebugPrivilege 3876 rmass.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3052 wrote to memory of 3876 3052 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe 82 PID 3052 wrote to memory of 3876 3052 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe 82 PID 3052 wrote to memory of 3876 3052 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe 82 PID 3876 wrote to memory of 616 3876 rmass.exe 5 PID 3876 wrote to memory of 3424 3876 rmass.exe 56 PID 3876 wrote to memory of 1064 3876 rmass.exe 83 PID 3876 wrote to memory of 1064 3876 rmass.exe 83 PID 3876 wrote to memory of 1064 3876 rmass.exe 83
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe"C:\Users\Admin\AppData\Local\Temp\b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\RECOVER32.DLL
- Size 5KB
- SHA256 9e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
- MD5 2b2c28a7a01f9584fe220ef84003427f
- SHA1 5fc023df0b5064045eb8de7f2dbe26f07f6fec70
- SHA512 39192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
- SSDEEP 48:6CsrGV5e2/WJbm73k2vZcsrkqSq2cxc2G5ZwJOFl:SqV5Roa73kQ/kqqAD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ahuy.exe
- Size 65KB
- SHA256 99363ad65b02d867553b6b47aaa910d126e2cc1ef8bc5b9e67a5e4a3de9ef474
- MD5 54d8e5b0f2a0bbe63e20d7b1d8492b6f
- SHA1 e4ec25e6560e78892214aabac6607d473a394fa1
- SHA512 2f91a8e05dad94657ff24be2e9c9ce664d2b8d5e15fe2fdd4395ff9a52c5d22ca062f6fac28b497e4c85dc4b3c13ae355ad24ccc6f6cfed59c4dc43f459ac78d
- SSDEEP 768:jIUihihFX+6TPPngdXnYSizpNyjdrJcGbYyQfbHEmn5fE9Z8Slv2a5YgVNXp2:jQ9YSiKBJcGVGh6Z8avLXA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ntdbg.exe
- Size 66KB
- SHA256 19052c41695695241018ec53775c8190b70dc3bc261f8dc86a863fe437aec5df
- MD5 8e90ce3618e885693555560487528d08
- SHA1 67f9bb9ba31950de2dfb726c5ed2f12942c60105
- SHA512 ad5beed863589c64e44d8cf650b1abf9367e1d200add26685afd46e287e82a2ec0b6ba994e1e2fc9e1cfb6d283f3a09a2acea958d88925a21f1c11fede0cfb8a
- SSDEEP 768:ErzYn5OY6DhtmPsxMzkvaAVLW4rIF2T5cpRZ75NbZPdd/loJ:Ew5P6DhVMzq5LW8IEibbZb/e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rmass.exe
- Size 63KB
- SHA256 b462ce67e8d7fa20a0d55a13eec08108965e102add6940e148cde798c3c24f2f
- MD5 1d0f03c689152c033ececf8006e57bf1
- SHA1 f194025249c66a00b52db8a7f817a938b4ea335a
- SHA512 9d71e688c73dce6d3c069850bc7174ed2968eed7407541a1972ffdc91c5cf65a0bc66bbf52638d97d44754904cb382ddd7a8349c0c40006df8e139bfca130051
- SSDEEP 768:rAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGKQLddOW/g4WvU+oQ:sUNHFKQbIkHvGMdO74k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\etc\hosts
- Size 1KB
- SHA256 15c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
- MD5 6f47b62de25d1745e296a06b3f98ed19
- SHA1 a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
- SHA512 dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7
- MD5 SHA1 SHA512