Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe
- Size 221KB
- Sample201110-9mcf7npgf6
- SHA256 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117
- MD5 4a914d802d72ca93c46ad1d59ef4481e
- SHA1 84eac74c0c06de95b4435839beff13d1b46d88da
- SHA512 e72ad9faefa39079f22ccc8173c295e86bcb230a8dafbd4ed6358032b24f3ea9c4cd1a2b7691a6edf740c9cd64ae9d9b98fca4f7c73578dd6c5a174b18540c7c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\NlsLexicons002232.exe" NlsLexicons002232.exe - Executes dropped EXE 3 IoCs
pid Process 1988 NlsLexicons002232.exe 1980 NlsLexicons002232.exe 524 NlsLexicons002232.exe - Deletes itself 1 IoCs
pid Process 1724 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*NlsLexicons002232 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe" 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\NlsLexicons002232 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe" 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage NlsLexicons002232.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage NlsLexicons002232.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage NlsLexicons002232.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 NlsLexicons002232.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132494802048581216" NlsLexicons002232.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1160 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1220 timeout.exe - Suspicious behavior: EnumeratesProcesses 71 IoCs
pid Process 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe 1988 NlsLexicons002232.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1988 NlsLexicons002232.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 596 wrote to memory of 1988 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 26 PID 596 wrote to memory of 1988 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 26 PID 596 wrote to memory of 1988 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 26 PID 596 wrote to memory of 1096 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 27 PID 596 wrote to memory of 1096 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 27 PID 596 wrote to memory of 1096 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 27 PID 596 wrote to memory of 1724 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 28 PID 596 wrote to memory of 1724 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 28 PID 596 wrote to memory of 1724 596 1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe 28 PID 1724 wrote to memory of 1220 1724 cmd.exe 32 PID 1724 wrote to memory of 1220 1724 cmd.exe 32 PID 1724 wrote to memory of 1220 1724 cmd.exe 32 PID 1988 wrote to memory of 1160 1988 NlsLexicons002232.exe 35 PID 1988 wrote to memory of 1160 1988 NlsLexicons002232.exe 35 PID 1988 wrote to memory of 1160 1988 NlsLexicons002232.exe 35 PID 1744 wrote to memory of 1980 1744 taskeng.exe 40 PID 1744 wrote to memory of 1980 1744 taskeng.exe 40 PID 1744 wrote to memory of 1980 1744 taskeng.exe 40 PID 1744 wrote to memory of 524 1744 taskeng.exe 41 PID 1744 wrote to memory of 524 1744 taskeng.exe 41 PID 1744 wrote to memory of 524 1744 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe"C:\Users\Admin\AppData\Local\Temp\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1096
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe" && del "C:\Users\Admin\AppData\Local\Temp\1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1220
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:304
-
C:\Windows\system32\taskeng.exetaskeng.exe {9B2B8EED-82D2-4523-8AF2-64514E507EF5} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exe arguments2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\NlsLexicons002232.exe arguments2⤵
- Executes dropped EXE
PID:524
-