5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4

General

Target

5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
Size

4.2MB
MD5

45177df44d074eee7a644ff06bdbf462
SHA1

4dcdb661bb99370beea4423e71ec322e8d13a0d0
SHA256

5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4
SHA512

46abe4164981147ab64c2c860c5887a181f060964c16fdc8e8f5d5b89f7f4459098a29381234595142dccd21883fc89fca4dddc97304d963f0d1809584a1fa34
SSDEEP

98304:tD4WgEZwKnxnA5OCdJR3xLzgI8IP7lSkQuIXFtN:eW3wKnxnaR3F0I8IPZSkQuIX/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

cclaner.exe

pid process

2964 cclaner.exe

pid	process
2964	cclaner.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1268 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3620 timeout.exe

pid	process
1268	schtasks.exe

pid	process
3620	timeout.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe

pid	process
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.execclaner.exe

description pid process

Token: SeDebugPrivilege 4580 5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
Token: SeDebugPrivilege 2964 cclaner.exe

description	pid	process
Token: SeDebugPrivilege	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
Token: SeDebugPrivilege	2964	cclaner.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.execmd.execmd.exe

description	pid	process	target process
PID 4580 wrote to memory of 4836	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4580 wrote to memory of 4836	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4580 wrote to memory of 4836	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4580 wrote to memory of 2348	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4580 wrote to memory of 2348	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4580 wrote to memory of 2348	4580	5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe	cmd.exe
PID 4836 wrote to memory of 1268	4836	cmd.exe	schtasks.exe
PID 4836 wrote to memory of 1268	4836	cmd.exe	schtasks.exe
PID 4836 wrote to memory of 1268	4836	cmd.exe	schtasks.exe
PID 2348 wrote to memory of 3620	2348	cmd.exe	timeout.exe
PID 2348 wrote to memory of 3620	2348	cmd.exe	timeout.exe
PID 2348 wrote to memory of 3620	2348	cmd.exe	timeout.exe
PID 2348 wrote to memory of 2964	2348	cmd.exe	cclaner.exe
PID 2348 wrote to memory of 2964	2348	cmd.exe	cclaner.exe
PID 2348 wrote to memory of 2964	2348	cmd.exe	cclaner.exe

C:\Users\Admin\AppData\Local\Temp\5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
"C:\Users\Admin\AppData\Local\Temp\5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131 /tr '"C:\Users\Admin\AppData\Roaming\cclaner.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn 5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131 /tr '"C:\Users\Admin\AppData\Roaming\cclaner.exe"'
3⤵
- Creates scheduled task(s)
PID:1268

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7511.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3620

C:\Users\Admin\AppData\Roaming\cclaner.exe
"C:\Users\Admin\AppData\Roaming\cclaner.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7511.tmp.bat
Filesize
151B

MD5
41a477a7ac1c628de36c1c5f4e50c45c

SHA1
3fcb52f3166ddaba7b72e8e9bc6c21358d4c19f4

SHA256
7638ea454c6aad1e49e4f3371b2ebfd1884e8cf46bbf2a7043f44116e423d3ac

SHA512
15ef55e1fae866c13e3f046e01c1e81d3363a1030ed356bea73093113f81e1eb18195e301be2fbe4b23a4508c6d53ba94c1bd2eaec428a3a77b73fdca68e70d9

Download Submit
C:\Users\Admin\AppData\Roaming\cclaner.exe
Filesize
4.2MB

MD5
45177df44d074eee7a644ff06bdbf462

SHA1
4dcdb661bb99370beea4423e71ec322e8d13a0d0

SHA256
5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4

SHA512
46abe4164981147ab64c2c860c5887a181f060964c16fdc8e8f5d5b89f7f4459098a29381234595142dccd21883fc89fca4dddc97304d963f0d1809584a1fa34

Download Submit
C:\Users\Admin\AppData\Roaming\cclaner.exe
Filesize
4.2MB

MD5
45177df44d074eee7a644ff06bdbf462

SHA1
4dcdb661bb99370beea4423e71ec322e8d13a0d0

SHA256
5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4

SHA512
46abe4164981147ab64c2c860c5887a181f060964c16fdc8e8f5d5b89f7f4459098a29381234595142dccd21883fc89fca4dddc97304d963f0d1809584a1fa34

Download Submit
memory/1268-138-0x0000000000000000-mapping.dmp

Download
memory/2348-137-0x0000000000000000-mapping.dmp

Download
memory/2964-141-0x0000000000000000-mapping.dmp

Download
memory/2964-144-0x0000000006430000-0x0000000006496000-memory.dmp

Filesize
408KB

Download
memory/3620-140-0x0000000000000000-mapping.dmp

Download
memory/4580-135-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/4580-132-0x0000000000600000-0x0000000000A34000-memory.dmp

Filesize
4.2MB

Download
memory/4580-134-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/4580-133-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/4836-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads