04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac

Analysis

max time kernel
226s
max time network
302s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Size

543KB
MD5

f2bf2ccce67ddbb35416ad1446fbe272
SHA1

75e8b2e1a68f69c6b518c7c8f9dcd9ef8e1a1323
SHA256

04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac
SHA512

bd7cb9b084e77d769996d5a9cddbf961690fcd546fe50e1c086f78d14f0458abcef518fe7613a07b77d595ad8c764eb4d5eb27174dc9ab6c97f6d44bb4c79e2e
SSDEEP

6144:SRMLwiZtLix78pD/AUFr/ZHdjx60AMP9s4wzQpGQ65HVOMQga8cV9/yudsPE4TP7:9EiZa4Y+ZY6s4g155RA/yuip+1suOd+I

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1884	COUNTE~1.EXE

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\Cerberus\\server.exe Restart"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\Cerberus\\server.exe Restart"	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}	iexplore.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1884-65-0x0000000010410000-0x00000000104D4000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
1884	COUNTE~1.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\Cerberus\\server.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\Cerberus\\server.exe"	iexplore.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cerberus\logs.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\logs.dat	iexplore.exe
File created	C:\Windows\SysWOW64\Cerberus\plugin.dat	iexplore.exe
File created	C:\Windows\SysWOW64\Cerberus\server.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\server.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\plugin.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1884	COUNTE~1.EXE
1884	COUNTE~1.EXE
1884	COUNTE~1.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	iexplore.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	COUNTE~1.EXE
Token: SeDebugPrivilege	1884	COUNTE~1.EXE
Token: SeDebugPrivilege	1884	COUNTE~1.EXE
Token: SeDebugPrivilege	1884	COUNTE~1.EXE
Token: SeDebugPrivilege	1804	iexplore.exe
Token: SeDebugPrivilege	1804	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1644 wrote to memory of 1884	1644	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	28
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29
PID 1884 wrote to memory of 1804	1884	COUNTE~1.EXE	29

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1412
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2024
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1120
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:308
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:108
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1868

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
  "C:\Users\Admin\AppData\Local\Temp\04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1804

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
C:\Windows\SysWOW64\Cerberus\plugin.dat

Filesize
568KB

MD5
5df04454161b456e94ae6fa5f9b80f13

SHA1
8c59e40ab5f9dc3101c5d1d8c2d2fec46535d77d

SHA256
bc226ceff041c3af6874997056e1aea07ff4643b55e8c17ebf105fedd2df34c1

SHA512
969004c6f0ba531fccb18169dcbf28ca8f2569f01b37b2c4df3a226c5958f2804326bc15c5e73edf6d7ebaba698c99a9c275c2bbd4be74d5db66a55f42c80fa0

Download Submit
C:\Windows\SysWOW64\Cerberus\server.exe

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
memory/260-89-0x00000000104E0000-0x00000000104EA000-memory.dmp

Filesize
40KB

Download
memory/1644-317-0x0000000001000000-0x000000000110FC53-memory.dmp

Filesize
1.1MB

Download
memory/1644-309-0x0000000010660000-0x000000001066A000-memory.dmp

Filesize
40KB

Download
memory/1644-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download
memory/1644-55-0x0000000001000000-0x000000000110FC53-memory.dmp

Filesize
1.1MB

Download
memory/1884-69-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/1884-92-0x00000000104F0000-0x00000000104FA000-memory.dmp

Filesize
40KB

Download
memory/1884-101-0x0000000010500000-0x000000001050A000-memory.dmp

Filesize
40KB

Download
memory/1884-110-0x0000000010510000-0x000000001051A000-memory.dmp

Filesize
40KB

Download
memory/1884-119-0x0000000010520000-0x000000001052A000-memory.dmp

Filesize
40KB

Download
memory/1884-128-0x0000000010530000-0x000000001053A000-memory.dmp

Filesize
40KB

Download
memory/1884-83-0x00000000104E0000-0x00000000104EA000-memory.dmp

Filesize
40KB

Download
memory/1884-76-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1884-65-0x0000000010410000-0x00000000104D4000-memory.dmp

Filesize
784KB

Download