bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

General

Target

bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
Size

84KB
MD5

f8f51015c2021d281de4727c5224ea67
SHA1

63f427ced474d165eb55bcd9bbc54fd45bb79f0f
SHA256

bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360
SHA512

c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248
SSDEEP

1536:yZRhvqPRS9t8g0T/hitN/u/EFqm2pr0jeddFQcNZBT9HjRrbiVRl:4RhSP4l0FitN/OEPve7jRrbml

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3808	syshost.exe
1496	syshost.exe

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5040	netsh.exe
4616	netsh.exe
3672	netsh.exe
3004	netsh.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	162.243.56.54
Destination IP	95.211.195.245
Destination IP	91.213.8.35
Destination IP	94.231.81.244

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syshost32 = "C:\\Windows\\Installer\\{709F0969-0265-960F-93A5-65FA69603E79}\\syshost.exe"	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
File opened for modification	C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
File opened for modification	C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe.tmp	syshost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	syshost.exe
1496	syshost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1496	syshost.exe
Token: SeIncreaseQuotaPrivilege	1496	syshost.exe
Token: SeShutdownPrivilege	1496	syshost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1496	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	83
PID 4084 wrote to memory of 1496	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	83
PID 4084 wrote to memory of 1496	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	83
PID 4084 wrote to memory of 3688	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	84
PID 4084 wrote to memory of 3688	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	84
PID 4084 wrote to memory of 3688	4084	bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe	84
PID 1496 wrote to memory of 5040	1496	syshost.exe	86
PID 1496 wrote to memory of 5040	1496	syshost.exe	86
PID 1496 wrote to memory of 5040	1496	syshost.exe	86
PID 1496 wrote to memory of 4616	1496	syshost.exe	88
PID 1496 wrote to memory of 4616	1496	syshost.exe	88
PID 1496 wrote to memory of 4616	1496	syshost.exe	88
PID 1496 wrote to memory of 3672	1496	syshost.exe	89
PID 1496 wrote to memory of 3672	1496	syshost.exe	89
PID 1496 wrote to memory of 3672	1496	syshost.exe	89
PID 1496 wrote to memory of 3004	1496	syshost.exe	93
PID 1496 wrote to memory of 3004	1496	syshost.exe	93
PID 1496 wrote to memory of 3004	1496	syshost.exe	93

C:\Users\Admin\AppData\Local\Temp\bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe
"C:\Users\Admin\AppData\Local\Temp\bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe
  C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:5040
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:4616
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:3672
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\9dd3a4c7.tmp"
  2⤵
  PID:3688

C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe
"C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe" /service
1⤵
- Executes dropped EXE
PID:3808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
C:\Windows\Installer\{709F0969-0265-960F-93A5-65FA69603E79}\syshost.exe

Filesize
84KB

MD5
f8f51015c2021d281de4727c5224ea67

SHA1
63f427ced474d165eb55bcd9bbc54fd45bb79f0f

SHA256
bdf1c0322240502a828bb54531372ddd872961b23d3a88b43f7332a47b643360

SHA512
c7e456729f0d99542c9c08fb44d66b5024576af8c628690cf2ec1f5634ebae18da32c35552f1276af4d6f5ea9181b097cc7b500aeab866f0e5fb07700c769248

Download Submit
memory/1496-145-0x0000000000A30000-0x0000000000A49000-memory.dmp

Filesize
100KB

Download
memory/1496-147-0x0000000000A30000-0x0000000000A49000-memory.dmp

Filesize
100KB

Download
memory/4084-133-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/4084-137-0x0000000000060000-0x0000000000066000-memory.dmp

Filesize
24KB

Download
memory/4084-136-0x0000000000B50000-0x0000000000B69000-memory.dmp

Filesize
100KB

Download
memory/4084-134-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing