439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f

General

Target

439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe
Size

560KB
MD5

93c53a0499128ff9b51e98ce8775019e
SHA1

6fcae723d431280087066eb072f9579a47476cfb
SHA256

439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f
SHA512

fe5eb37d0a5f85700a8696c1eb422233a68f1ccff96bb7222a2f7878ee0f72cde7853de2134b01624b27c08e743d179549b84b2fc4f82dc96d91761428d88dd9
SSDEEP

12288:I9mnjMfSRdT64QuWqlJgYV3P5YQfdpsY0T6ajydT:I9mnjPrbQuBlJZ+b1T10T

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

DbProtectSupport.exe

pid process

1576 DbProtectSupport.exe
Loads dropped DLL 1 IoCs

Processes:

439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe

pid process

1212 439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe

pid	process
1576	DbProtectSupport.exe

pid	process
1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe

Drops file in Program Files directory 5 IoCs

Processes:

439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exeDbProtectSupport.exe

description	ioc	process
File created	C:\Program Files\DbProtectSupport\DbProtectSupport.exe.bak	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe
File created	C:\Program Files\DbProtectSupport\DbProtectSupport.exe	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe
File opened for modification	C:\Program Files\DbProtectSupport\DbProtectSupport.exe	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe
File opened for modification	C:\Program Files\DbProtectSupport\fake.cfg	DbProtectSupport.exe
File created	C:\Program Files\DbProtectSupport\fake.cfg	DbProtectSupport.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DbProtectSupport.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DbProtectSupport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DbProtectSupport.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DbProtectSupport.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DbProtectSupport.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

TASKKILL.exe

pid process

1724 TASKKILL.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

DbProtectSupport.exe

pid process

1576 DbProtectSupport.exe
1576 DbProtectSupport.exe
1576 DbProtectSupport.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TASKKILL.exe

description pid process

Token: SeDebugPrivilege 1724 TASKKILL.exe

pid	process
1724	TASKKILL.exe

pid	process
1576	DbProtectSupport.exe
1576	DbProtectSupport.exe
1576	DbProtectSupport.exe

description	pid	process
Token: SeDebugPrivilege	1724	TASKKILL.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe

description	pid	process	target process
PID 1212 wrote to memory of 1724	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	TASKKILL.exe
PID 1212 wrote to memory of 1724	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	TASKKILL.exe
PID 1212 wrote to memory of 1724	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	TASKKILL.exe
PID 1212 wrote to memory of 1724	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	TASKKILL.exe
PID 1212 wrote to memory of 1576	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	DbProtectSupport.exe
PID 1212 wrote to memory of 1576	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	DbProtectSupport.exe
PID 1212 wrote to memory of 1576	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	DbProtectSupport.exe
PID 1212 wrote to memory of 1576	1212	439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe	DbProtectSupport.exe

C:\Users\Admin\AppData\Local\Temp\439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe
"C:\Users\Admin\AppData\Local\Temp\439d0e006060e687b9a884427323832832129ddc0d863af40a8c90b553b89e1f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM DbProtectSupport.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Program Files\DbProtectSupport\DbProtectSupport.exe
"C:\Program Files\DbProtectSupport\DbProtectSupport.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DbProtectSupport\DbProtectSupport.exe

Filesize
281KB

MD5
a41c22e0ca4056ba34e71b6d55a13514

SHA1
1a1cec6c5f355f262dbff826507aef16c4932899

SHA256
356446a60d7671e0d085157f147f8b3210b0005814c77102037d66480faeeba4

SHA512
add8f3c36c16bdcf4544449ce1361999223a01b8fab4ba83b25fc6a35a1540c6ea050deecdd3b209df38abfde6bd5bce15c97e8d52f3c887d340ff02e8b8024d

Download Submit
\Program Files\DbProtectSupport\DbProtectSupport.exe

Filesize
281KB

MD5
a41c22e0ca4056ba34e71b6d55a13514

SHA1
1a1cec6c5f355f262dbff826507aef16c4932899

SHA256
356446a60d7671e0d085157f147f8b3210b0005814c77102037d66480faeeba4

SHA512
add8f3c36c16bdcf4544449ce1361999223a01b8fab4ba83b25fc6a35a1540c6ea050deecdd3b209df38abfde6bd5bce15c97e8d52f3c887d340ff02e8b8024d

Download Submit
memory/1576-56-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads