Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 09:01
Behavioral task
behavioral1
Sample
e123613672abc38913dcd968faecea29.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e123613672abc38913dcd968faecea29.exe
Resource
win10v2004-20240802-en
General
-
Target
e123613672abc38913dcd968faecea29.exe
-
Size
48KB
-
MD5
e123613672abc38913dcd968faecea29
-
SHA1
626e7906b9d344c97d74223e31c5953eb7222d74
-
SHA256
f1cf2b82b0ec58426d7983e939d0989ad7bd5425993012eab4455c6ad0bbe22b
-
SHA512
19d7d25aa5e38bc330cd43a74346ce7d964cad9d0d4b4f270dea0905bd15b39c48e3cf54cb2a9957c1ccc3df95da82325fdd065299b2fb80dde8d4677d2ced96
-
SSDEEP
768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67FhPC:Ub1MsHz3JDwhyWr+N95OTga6G
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SySyeu\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259441643.dll" e123613672abc38913dcd968faecea29.exe -
Deletes itself 1 IoCs
pid Process 2080 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 SySyeu.exe -
Loads dropped DLL 7 IoCs
pid Process 2904 e123613672abc38913dcd968faecea29.exe 3052 svchost.exe 3052 svchost.exe 2752 SySyeu.exe 2752 SySyeu.exe 2752 SySyeu.exe 2752 SySyeu.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SySyeu.exe svchost.exe File opened for modification C:\Windows\SysWOW64\SySyeu.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SySyeu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e123613672abc38913dcd968faecea29.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2080 cmd.exe 2084 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2084 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2904 e123613672abc38913dcd968faecea29.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2904 e123613672abc38913dcd968faecea29.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2904 e123613672abc38913dcd968faecea29.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2080 2904 e123613672abc38913dcd968faecea29.exe 32 PID 2904 wrote to memory of 2080 2904 e123613672abc38913dcd968faecea29.exe 32 PID 2904 wrote to memory of 2080 2904 e123613672abc38913dcd968faecea29.exe 32 PID 2904 wrote to memory of 2080 2904 e123613672abc38913dcd968faecea29.exe 32 PID 2080 wrote to memory of 2084 2080 cmd.exe 34 PID 2080 wrote to memory of 2084 2080 cmd.exe 34 PID 2080 wrote to memory of 2084 2080 cmd.exe 34 PID 2080 wrote to memory of 2084 2080 cmd.exe 34 PID 3052 wrote to memory of 2752 3052 svchost.exe 35 PID 3052 wrote to memory of 2752 3052 svchost.exe 35 PID 3052 wrote to memory of 2752 3052 svchost.exe 35 PID 3052 wrote to memory of 2752 3052 svchost.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\e123613672abc38913dcd968faecea29.exe"C:\Users\Admin\AppData\Local\Temp\e123613672abc38913dcd968faecea29.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\e123613672abc38913dcd968faecea29.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2084
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SySyeu"1⤵PID:3036
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SySyeu"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\SySyeu.exeC:\Windows\system32\SySyeu.exe "c:\users\admin\appdata\local\temp\259441643.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5689bd62c2a904d7a480b6a2317e84eb2
SHA1f7fbd895d5aab47f936d1df8d6ae84bce0e9239f
SHA25618cbd8475a2050f428a62c1c743484eceaea01bd5048b20adacac6600c0aff27
SHA512703ee8f8e675e7a99bafa921388ae6bbb2833e5ac2710eafd09dc0121598e6f20e5a2fe4df1d7e20a2a93481a8478be4b4f834ef062be2b47b00a7f080a47bf9
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d