bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0

General

Target

bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe
Size

69KB
MD5

9f02f3b2bc5e861b62afbc2aacb82fc4
SHA1

9e583659be30b87d30d53c6d1c52f8edee881a80
SHA256

bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0
SHA512

90da0e11617c1e9fe928c9df5b802376f9d235345e88d43f1c6210a6b44a73c2f787c91dcf51e7e3eb754fec9225cc0b99e949c6415a101af4ce3fd0d60bdf02

Score

10^/10

evasion suricata

Malware Config

Signatures

suricata: ET MALWARE [PTsecurity] Botnet Nitol.B Checkin
suricata: ET MALWARE [PTsecurity] Botnet Nitol.B Checkin
suricata
Executes dropped EXE 1 IoCs

Processes:

cwqhost.exe

pid process

2040 cwqhost.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

996 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1288 cmd.exe

pid	process
2040	cwqhost.exe

pid	process
996	attrib.exe

pid	process
1288	cmd.exe

Drops file in Windows directory 3 IoCs

Processes:

attrib.exebef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\cwqhost.exe	attrib.exe
File created	C:\Windows\Debug\cwqhost.exe	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe
File opened for modification	C:\Windows\Debug\cwqhost.exe	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cwqhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cwqhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	cwqhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

description pid process

Token: SeIncBasePriorityPrivilege 1604 bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe

description	pid	process	target process
PID 1604 wrote to memory of 996	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	attrib.exe
PID 1604 wrote to memory of 996	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	attrib.exe
PID 1604 wrote to memory of 996	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	attrib.exe
PID 1604 wrote to memory of 996	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	attrib.exe
PID 1604 wrote to memory of 1288	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	cmd.exe
PID 1604 wrote to memory of 1288	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	cmd.exe
PID 1604 wrote to memory of 1288	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	cmd.exe
PID 1604 wrote to memory of 1288	1604	bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

996 attrib.exe

pid	process
996	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe
"C:\Users\Admin\AppData\Local\Temp\bef074036da6d2b09aeed1e29f7f965af9153783f1e6822dc7a455b0bd1796b0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\cwqhost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BEF074~1.EXE > nul
2⤵
- Deletes itself
PID:1288

C:\Windows\Debug\cwqhost.exe
C:\Windows\Debug\cwqhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\cwqhost.exe

Filesize
69KB

MD5
c86991ddebc72b2e5bbc9a9284076df7

SHA1
1da11003f97122b252924ac7ace4f9a771e67a95

SHA256
dfbeab5a6d4c3eb74e435b15d3a25f83f7e69b8575975ce3e7d9242499c8c7b4

SHA512
3baaa2b388ac1554ddbdf67e43d0de64b0a4107cfec6c286f745900e94f04876401ef3838c43d20043e05021d27bd56fd7f0b490c56c30bf5c94b99fe1d1471e

Download Submit
C:\Windows\debug\cwqhost.exe

Filesize
69KB

MD5
c86991ddebc72b2e5bbc9a9284076df7

SHA1
1da11003f97122b252924ac7ace4f9a771e67a95

SHA256
dfbeab5a6d4c3eb74e435b15d3a25f83f7e69b8575975ce3e7d9242499c8c7b4

SHA512
3baaa2b388ac1554ddbdf67e43d0de64b0a4107cfec6c286f745900e94f04876401ef3838c43d20043e05021d27bd56fd7f0b490c56c30bf5c94b99fe1d1471e

Download Submit
memory/996-55-0x0000000000000000-mapping.dmp

Download
memory/1288-59-0x0000000000000000-mapping.dmp

Download
memory/1604-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads