Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 11:01
Static task
static1
Behavioral task
behavioral1
Sample
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe
Resource
win10v2004-20220414-en
General
-
Target
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe
-
Size
241KB
-
MD5
4b19e294bfdf8b2d02391b566fd99501
-
SHA1
a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
-
SHA256
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
-
SHA512
4fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
suricata: ET MALWARE IRC Nick change on non-standard port
suricata: ET MALWARE IRC Nick change on non-standard port
-
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\LMCServ.exe" 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe -
Executes dropped EXE 2 IoCs
Processes:
LMCServ.exeLMCServ.exepid process 592 LMCServ.exe 2016 LMCServ.exe -
Processes:
resource yara_rule behavioral1/memory/1532-55-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1532-60-0x0000000000400000-0x000000000043E000-memory.dmp upx \Windows\SysWOW64\LMCServ.exe upx \Windows\SysWOW64\LMCServ.exe upx C:\Windows\SysWOW64\LMCServ.exe upx C:\Windows\SysWOW64\LMCServ.exe upx C:\Windows\SysWOW64\LMCServ.exe upx behavioral1/memory/592-80-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exepid process 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\LMCServ.exe" 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe -
Drops file in System32 directory 4 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exedescription ioc process File created C:\Windows\SysWOW64\LMCServ.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe File opened for modification C:\Windows\SysWOW64\LMCServ.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe File opened for modification C:\Windows\SysWOW64\LMCServ.exe LMCServ.exe File created C:\Windows\SysWOW64\LMCServ.exe LMCServ.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exedescription pid process target process PID 1532 set thread context of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 592 set thread context of 2016 592 LMCServ.exe LMCServ.exe -
Drops file in Windows directory 1 IoCs
Processes:
LMCServ.exedescription ioc process File created C:\Windows\logfile32.txt LMCServ.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exepid process 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 2016 LMCServ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exedescription pid process Token: SeDebugPrivilege 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe Token: SeDebugPrivilege 2016 LMCServ.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exepid process 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 592 LMCServ.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exeLMCServ.exedescription pid process target process PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 1532 wrote to memory of 908 1532 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe PID 908 wrote to memory of 592 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe LMCServ.exe PID 908 wrote to memory of 592 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe LMCServ.exe PID 908 wrote to memory of 592 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe LMCServ.exe PID 908 wrote to memory of 592 908 9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe PID 592 wrote to memory of 2016 592 LMCServ.exe LMCServ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\LMCServ.exe"C:\Windows\system32\LMCServ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\LMCServ.exe"C:\Windows\SysWOW64\LMCServ.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\LMCServ.exeFilesize
241KB
MD54b19e294bfdf8b2d02391b566fd99501
SHA1a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
SHA2569153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
SHA5124fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
-
C:\Windows\SysWOW64\LMCServ.exeFilesize
241KB
MD54b19e294bfdf8b2d02391b566fd99501
SHA1a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
SHA2569153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
SHA5124fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
-
C:\Windows\SysWOW64\LMCServ.exeFilesize
241KB
MD54b19e294bfdf8b2d02391b566fd99501
SHA1a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
SHA2569153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
SHA5124fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
-
\Windows\SysWOW64\LMCServ.exeFilesize
241KB
MD54b19e294bfdf8b2d02391b566fd99501
SHA1a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
SHA2569153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
SHA5124fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
-
\Windows\SysWOW64\LMCServ.exeFilesize
241KB
MD54b19e294bfdf8b2d02391b566fd99501
SHA1a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc
SHA2569153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec
SHA5124fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707
-
memory/592-67-0x0000000000000000-mapping.dmp
-
memory/592-80-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/908-64-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/908-63-0x0000000075581000-0x0000000075583000-memory.dmpFilesize
8KB
-
memory/908-59-0x00000000004084F0-mapping.dmp
-
memory/908-58-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/908-74-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/908-57-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/908-62-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1532-55-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1532-60-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2016-75-0x00000000004084F0-mapping.dmp
-
memory/2016-81-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2016-82-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB