d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06

General

Target

d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Size

367KB
MD5

0b71cb4d6923af780752af6bd33855a1
SHA1

8e326f020ee113e91d051f12162dc0ae11c5fcc6
SHA256

d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06
SHA512

8c90b73a21e7d6bb60d1aef72e5bcb813b83b8b22f1aabb5f8a35b80ba394ea0729464680b1762bbab83d26dc2221bcf92bb88b0c3d12f0bb5ef72dcf6c59a78
SSDEEP

6144:eafRhEqNEZNR5iOjSNAQ4Q+jO1PCLmQ1p3iWEKFAMk0QY/GDQoyazscUdEsC5wyj:ffRhEqENM3NTeLP38K1kzY+DQoyazsf2

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
628	Server.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-61-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	Server.exe
628	Server.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: SeIncBasePriorityPrivilege	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: 33	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: SeIncBasePriorityPrivilege	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: 33	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: SeIncBasePriorityPrivilege	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
Token: 33	628	Server.exe
Token: SeIncBasePriorityPrivilege	628	Server.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 628	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe	27
PID 1940 wrote to memory of 628	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe	27
PID 1940 wrote to memory of 628	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe	27
PID 1940 wrote to memory of 628	1940	d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe	27
PID 628 wrote to memory of 1284	628	Server.exe	16
PID 628 wrote to memory of 1284	628	Server.exe	16
PID 628 wrote to memory of 1284	628	Server.exe	16
PID 628 wrote to memory of 1284	628	Server.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe
  "C:\Users\Admin\AppData\Local\Temp\d17d8cb7fd5fe7b2bd4d1be4ec30208f20e159848ea8b0a3d8d104a247ee1f06.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.04.26T20.48\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.04.26T20.48\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\Server.exe

Filesize
17KB

MD5
e6361c7005b104dfa196e7bba3026a61

SHA1
645820b4f900b28b488e0de12df4e3e45aae55bc

SHA256
5015077f26651c8186111e79eac3abe04de303aa83e6b6c03526ec0e62c46a8d

SHA512
193a4410b729a1d0ac73cdcd5f20f68c6b86be079e3764d4671907f42870dbf0dae6707c0798324302cec972cb22f5f7c7692e57ac623141387839a6a2f82c8c

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.04.26T20.48\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\Server.exe

Filesize
17KB

MD5
e6361c7005b104dfa196e7bba3026a61

SHA1
645820b4f900b28b488e0de12df4e3e45aae55bc

SHA256
5015077f26651c8186111e79eac3abe04de303aa83e6b6c03526ec0e62c46a8d

SHA512
193a4410b729a1d0ac73cdcd5f20f68c6b86be079e3764d4671907f42870dbf0dae6707c0798324302cec972cb22f5f7c7692e57ac623141387839a6a2f82c8c

Download Submit
memory/628-71-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/628-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-79-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/628-78-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-77-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/628-73-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/628-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/628-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-74-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1940-55-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1940-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1940-62-0x0000000000420000-0x0000000000492000-memory.dmp

Filesize
456KB

Download
memory/1940-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1940-57-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1940-56-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1940-59-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1940-80-0x0000000000420000-0x0000000000492000-memory.dmp

Filesize
456KB

Download
memory/1940-58-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing