9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d

General

Target

9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
Size

77KB
MD5

80d8de34a72a246cc00b87cd0dc6f7ad
SHA1

c0284a340a09b9ed97ed1a18e90f11573dc4aa6d
SHA256

9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d
SHA512

9a9337a8f247bbb55fc08ec6582ab3b630ed1ff0ae9c92c116a73937f4e49829dd77001c86fffa61babd6db057e035a46afe77af8ad068cf302e4f8fdbfcabf5
SSDEEP

1536:osyqFgD9LMz6UQWEmug3vE/YqYdXobsFz+YsvOV4CZX5Q01W65F:oJBff3YDdXobswYsmZpQ01NF

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 36 IoCs

flow	pid	Process
3	876	rundll32.exe
4	876	rundll32.exe
5	876	rundll32.exe
6	876	rundll32.exe
7	876	rundll32.exe
15	876	rundll32.exe
17	876	rundll32.exe
18	876	rundll32.exe
19	876	rundll32.exe
20	876	rundll32.exe
21	876	rundll32.exe
22	876	rundll32.exe
25	876	rundll32.exe
26	876	rundll32.exe
27	876	rundll32.exe
28	876	rundll32.exe
29	876	rundll32.exe
36	876	rundll32.exe
38	876	rundll32.exe
39	876	rundll32.exe
40	876	rundll32.exe
41	876	rundll32.exe
42	876	rundll32.exe
58	876	rundll32.exe
60	876	rundll32.exe
61	876	rundll32.exe
62	876	rundll32.exe
63	876	rundll32.exe
64	876	rundll32.exe
65	876	rundll32.exe
67	876	rundll32.exe
68	876	rundll32.exe
69	876	rundll32.exe
70	876	rundll32.exe
71	876	rundll32.exe
74	876	rundll32.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\usbinckey.sys	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe

Executes dropped EXE 1 IoCs

pid	Process
3868	cardctrl.exe

Loads dropped DLL 2 IoCs

pid	Process
4928	rundll32.exe
876	rundll32.exe

Unexpected DNS network traffic destination 24 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	168.95.192.1
Destination IP	208.67.222.222
Destination IP	165.87.201.244
Destination IP	165.87.201.244
Destination IP	209.166.160.36
Destination IP	208.67.222.222
Destination IP	209.166.160.36
Destination IP	208.67.222.222
Destination IP	209.166.160.36
Destination IP	208.67.222.222
Destination IP	168.95.192.1
Destination IP	168.95.192.1
Destination IP	165.87.201.244
Destination IP	168.95.192.1
Destination IP	209.166.160.36
Destination IP	208.67.222.222
Destination IP	209.166.160.36
Destination IP	165.87.201.244
Destination IP	168.95.192.1
Destination IP	168.95.192.1
Destination IP	209.166.160.36
Destination IP	165.87.201.244
Destination IP	165.87.201.244
Destination IP	208.67.222.222

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cardctrl.exe	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
File opened for modification	C:\Windows\SysWOW64\cardctrl.exe	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
File created	C:\Windows\SysWOW64\usbinckey.dll	cardctrl.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4308	ipconfig.exe
4632	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 4632	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	79
PID 2492 wrote to memory of 4632	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	79
PID 2492 wrote to memory of 4632	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	79
PID 3868 wrote to memory of 4308	3868	cardctrl.exe	82
PID 3868 wrote to memory of 4308	3868	cardctrl.exe	82
PID 3868 wrote to memory of 4308	3868	cardctrl.exe	82
PID 3868 wrote to memory of 876	3868	cardctrl.exe	83
PID 3868 wrote to memory of 876	3868	cardctrl.exe	83
PID 3868 wrote to memory of 876	3868	cardctrl.exe	83
PID 2492 wrote to memory of 4928	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	85
PID 2492 wrote to memory of 4928	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	85
PID 2492 wrote to memory of 4928	2492	9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe	85

C:\Users\Admin\AppData\Local\Temp\9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
"C:\Users\Admin\AppData\Local\Temp\9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig.exe
  2⤵
  - Gathers network information
  PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\usbinckey.dll,DelInterface C:\Users\Admin\AppData\Local\Temp\9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d.exe
  2⤵
  - Loads dropped DLL
  PID:4928

C:\Windows\SysWOW64\cardctrl.exe
C:\Windows\SysWOW64\cardctrl.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig.exe
  2⤵
  - Gathers network information
  PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\usbinckey.dll,GetInterface
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\cardctrl.exe

Filesize
77KB

MD5
80d8de34a72a246cc00b87cd0dc6f7ad

SHA1
c0284a340a09b9ed97ed1a18e90f11573dc4aa6d

SHA256
9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d

SHA512
9a9337a8f247bbb55fc08ec6582ab3b630ed1ff0ae9c92c116a73937f4e49829dd77001c86fffa61babd6db057e035a46afe77af8ad068cf302e4f8fdbfcabf5

Download Submit
C:\Windows\SysWOW64\cardctrl.exe

Filesize
77KB

MD5
80d8de34a72a246cc00b87cd0dc6f7ad

SHA1
c0284a340a09b9ed97ed1a18e90f11573dc4aa6d

SHA256
9044ebb75dcd8392c9e37a238b292f35abd391dde29ebd7888a4a4f5fa9a861d

SHA512
9a9337a8f247bbb55fc08ec6582ab3b630ed1ff0ae9c92c116a73937f4e49829dd77001c86fffa61babd6db057e035a46afe77af8ad068cf302e4f8fdbfcabf5

Download Submit
C:\Windows\SysWOW64\usbinckey.dll

Filesize
43KB

MD5
7ab16973c0e72adda99fa094434913ff

SHA1
75c02a9da9e4b3175d53c9baaecb191174f4412c

SHA256
1e678ec3145b862b163c2661980302a661a46e247c1efd921ad34855c1ef39b3

SHA512
48c558d1e788f6f8ce0b6695bdb8c9c971c7966db992efa7346194d9f221475d5ea9a96b08171c7e4fe5d91753c01f80bd5692b141ce76affa3e41d5328ad651

Download Submit
C:\Windows\SysWOW64\usbinckey.dll

Filesize
43KB

MD5
7ab16973c0e72adda99fa094434913ff

SHA1
75c02a9da9e4b3175d53c9baaecb191174f4412c

SHA256
1e678ec3145b862b163c2661980302a661a46e247c1efd921ad34855c1ef39b3

SHA512
48c558d1e788f6f8ce0b6695bdb8c9c971c7966db992efa7346194d9f221475d5ea9a96b08171c7e4fe5d91753c01f80bd5692b141ce76affa3e41d5328ad651

Download Submit
C:\Windows\SysWOW64\usbinckey.dll

Filesize
43KB

MD5
7ab16973c0e72adda99fa094434913ff

SHA1
75c02a9da9e4b3175d53c9baaecb191174f4412c

SHA256
1e678ec3145b862b163c2661980302a661a46e247c1efd921ad34855c1ef39b3

SHA512
48c558d1e788f6f8ce0b6695bdb8c9c971c7966db992efa7346194d9f221475d5ea9a96b08171c7e4fe5d91753c01f80bd5692b141ce76affa3e41d5328ad651

Download Submit
memory/876-136-0x0000000000000000-mapping.dmp

Download
memory/876-143-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2492-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3868-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4308-135-0x0000000000000000-mapping.dmp

Download
memory/4632-132-0x0000000000000000-mapping.dmp

Download
memory/4928-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing