7ec07222068548074307b65a582e648e5b13c7f1b0e5ff4ea0f4dee6b038f8ab

General

Target

c47b497c4854f1e9b09a2fde18969c80N.exe
Size

37KB
MD5

c47b497c4854f1e9b09a2fde18969c80
SHA1

7d25c6756fdde2356cf13abd420614a882dd200d
SHA256

7ec07222068548074307b65a582e648e5b13c7f1b0e5ff4ea0f4dee6b038f8ab
SHA512

f695dbbf92b9ac800f4fa10af4273a304b34224b936d78de145cb5f3a41fdc8aa23d6e27f32b61ef5ee8da808123b253f3266ca9e26b09ce70107da76883e565
SSDEEP

384:1mOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3U:3FdGdkrgYRwWS9rM+rMRa8NuQ4t

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2320	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	0.tcp.eu.ngrok.io
4	0.tcp.eu.ngrok.io
33	0.tcp.eu.ngrok.io

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: 33	2152	c47b497c4854f1e9b09a2fde18969c80N.exe
Token: SeIncBasePriorityPrivilege	2152	c47b497c4854f1e9b09a2fde18969c80N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2320	2152	c47b497c4854f1e9b09a2fde18969c80N.exe	31
PID 2152 wrote to memory of 2320	2152	c47b497c4854f1e9b09a2fde18969c80N.exe	31
PID 2152 wrote to memory of 2320	2152	c47b497c4854f1e9b09a2fde18969c80N.exe	31
PID 2152 wrote to memory of 2320	2152	c47b497c4854f1e9b09a2fde18969c80N.exe	31

C:\Users\Admin\AppData\Local\Temp\c47b497c4854f1e9b09a2fde18969c80N.exe
"C:\Users\Admin\AppData\Local\Temp\c47b497c4854f1e9b09a2fde18969c80N.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\c47b497c4854f1e9b09a2fde18969c80N.exe" "c47b497c4854f1e9b09a2fde18969c80N.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x00000000747D1000-0x00000000747D2000-memory.dmp

Filesize
4KB

Download
memory/2152-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-2-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-3-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads