bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

General

Target

bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
Size

84KB
MD5

f8f51015c2021d281de4727c5224ea67
SHA1

63f427ced474d165eb55bcd9bbc54fd45bb79f0f
SHA256

bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360
SHA512

c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248
SSDEEP

1536:yZRhvqPRS9t8g0T/hitN/u/EFqm2pr0jeddFQcNZBT9HjRrbiVRl:4RhSP4l0FitN/OEPve7jRrbml

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2004	syshost.exe
1496	syshost.exe

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1116	netsh.exe
1036	netsh.exe
1620	netsh.exe
1032	netsh.exe

Deletes itself 1 IoCs

pid	Process
1708	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.213.8.35
Destination IP	178.32.31.41
Destination IP	95.211.195.245
Destination IP	162.243.56.54
Destination IP	94.231.81.244

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\syshost32 = "C:\\Windows\\Installer\\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\\syshost.exe"	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
File opened for modification	C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe.tmp	syshost.exe
File created	C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1496	syshost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1496	syshost.exe
Token: SeIncreaseQuotaPrivilege	1496	syshost.exe
Token: SeShutdownPrivilege	1496	syshost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1496	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	27
PID 784 wrote to memory of 1496	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	27
PID 784 wrote to memory of 1496	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	27
PID 784 wrote to memory of 1496	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	27
PID 784 wrote to memory of 1708	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	28
PID 784 wrote to memory of 1708	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	28
PID 784 wrote to memory of 1708	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	28
PID 784 wrote to memory of 1708	784	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	28
PID 1496 wrote to memory of 1116	1496	syshost.exe	30
PID 1496 wrote to memory of 1116	1496	syshost.exe	30
PID 1496 wrote to memory of 1116	1496	syshost.exe	30
PID 1496 wrote to memory of 1116	1496	syshost.exe	30
PID 1496 wrote to memory of 1036	1496	syshost.exe	32
PID 1496 wrote to memory of 1036	1496	syshost.exe	32
PID 1496 wrote to memory of 1036	1496	syshost.exe	32
PID 1496 wrote to memory of 1036	1496	syshost.exe	32
PID 1496 wrote to memory of 1620	1496	syshost.exe	33
PID 1496 wrote to memory of 1620	1496	syshost.exe	33
PID 1496 wrote to memory of 1620	1496	syshost.exe	33
PID 1496 wrote to memory of 1620	1496	syshost.exe	33
PID 1496 wrote to memory of 1032	1496	syshost.exe	36
PID 1496 wrote to memory of 1032	1496	syshost.exe	36
PID 1496 wrote to memory of 1032	1496	syshost.exe	36
PID 1496 wrote to memory of 1032	1496	syshost.exe	36

C:\Users\Admin\AppData\Local\Temp\bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
"C:\Users\Admin\AppData\Local\Temp\bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe
  C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:1116
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:1036
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:1620
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e71137d6.tmp"
  2⤵
  - Deletes itself
  PID:1708

C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe
"C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe" /service
1⤵
- Executes dropped EXE
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
C:\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
\Windows\Installer\{EB24010B-355B-0F43-1356-BFCFF2F2C813}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
memory/784-57-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/784-56-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download
memory/784-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-54-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/784-69-0x0000000000050000-0x0000000000056000-memory.dmp

Filesize
24KB

Download
memory/1496-71-0x0000000000390000-0x00000000003A9000-memory.dmp

Filesize
100KB

Download
memory/1496-70-0x0000000000390000-0x00000000003A9000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing