Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-07-2022 11:01

General

  • Target

    9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe

  • Size

    241KB

  • MD5

    4b19e294bfdf8b2d02391b566fd99501

  • SHA1

    a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc

  • SHA256

    9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec

  • SHA512

    4fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • suricata: ET MALWARE IRC Nick change on non-standard port

    suricata: ET MALWARE IRC Nick change on non-standard port

  • suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)

    suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe
    "C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:332
    • C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe
      "C:\Users\Admin\AppData\Local\Temp\9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\SysWOW64\LMCServ.exe
        "C:\Windows\system32\LMCServ.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\SysWOW64\LMCServ.exe
          "C:\Windows\SysWOW64\LMCServ.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4412

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\LMCServ.exe
    Filesize

    241KB

    MD5

    4b19e294bfdf8b2d02391b566fd99501

    SHA1

    a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc

    SHA256

    9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec

    SHA512

    4fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707

  • C:\Windows\SysWOW64\LMCServ.exe
    Filesize

    241KB

    MD5

    4b19e294bfdf8b2d02391b566fd99501

    SHA1

    a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc

    SHA256

    9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec

    SHA512

    4fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707

  • C:\Windows\SysWOW64\LMCServ.exe
    Filesize

    241KB

    MD5

    4b19e294bfdf8b2d02391b566fd99501

    SHA1

    a63eb61f0de769dd3999ec8b6e4e3ec628e24bfc

    SHA256

    9153c6b5dc159531380577f13ba2b71ffc4ba3d936b37ac1c88df6e179d834ec

    SHA512

    4fa2a74b52a55774d76af6a4dfdcd1c32b0d187aa56e7718a4e2146539efd1b66061933df7828398670c9708b65ba25ce48ddee1db135ccf93f9541119070707

  • memory/332-137-0x0000000000400000-0x000000000043E000-memory.dmp
    Filesize

    248KB

  • memory/332-132-0x0000000000400000-0x000000000043E000-memory.dmp
    Filesize

    248KB

  • memory/4412-151-0x0000000000400000-0x0000000000455000-memory.dmp
    Filesize

    340KB

  • memory/4412-145-0x0000000000000000-mapping.dmp
  • memory/4880-138-0x0000000000400000-0x0000000000455000-memory.dmp
    Filesize

    340KB

  • memory/4880-136-0x0000000000400000-0x0000000000455000-memory.dmp
    Filesize

    340KB

  • memory/4880-134-0x0000000000400000-0x0000000000455000-memory.dmp
    Filesize

    340KB

  • memory/4880-133-0x0000000000000000-mapping.dmp
  • memory/4972-139-0x0000000000000000-mapping.dmp
  • memory/4972-144-0x0000000000400000-0x000000000043E000-memory.dmp
    Filesize

    248KB

  • memory/4972-150-0x0000000000400000-0x000000000043E000-memory.dmp
    Filesize

    248KB