ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223

General

Target

ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Size

347KB
MD5

bba7d452aae29e5061c8f41ab07d0f1e
SHA1

8da8e1e6c76b783836f18436187fcb9257504904
SHA256

ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223
SHA512

4f4003faa621de6615e970931d86326cc95b89e3b587e20f27b45fd9eeb31222e783245e8607d23b2fa70695722568e1d6953f8c2bdd8a8d98d314741245c514
SSDEEP

6144:QxMBi+F32eaD9BI0VJ2kAZtU4DCWjEIWoO55JlllAZOhDOnqxV:nToD9BUZi4DC8Ko+N8AKS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4704	DXREG.EXE

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	DXREG.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DirectX Plugin = "C:\\Windows\\dxreg.exe"	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DXREG.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DXREG.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	DXREG.EXE
File opened for modification	C:\Windows\PCGWIN32.LI4	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
File created	C:\Windows\dxreg.exe	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
File opened for modification	C:\Windows\dxreg.exe	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
File opened for modification	C:\WINDOWS\DXREG.EXE	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DXREG.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DXREG.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DXREG.EXE

Modifies registry class 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}\ = "2206238317"	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}\ = 8e2ccc82c331361fe40db77f1aad3043e849c260e7b21a19f677e5559877f15ad4880a27e045963b0451da778ea5623b79692f03dd794c545e464caa8fff0f5290ced0a570bb56967bb5e92700e5e0bb752e2b4221c8db59090b807909d3634611144b4a61febb6d29238461a9abe059394f1742f5ceeb23b9112c87023a10288e4442d8510c0b60815e68f37e262c0abc806ef42298f84812f8bfef12e238d72835a7d7eab587dbba3151d7bbc556e8c45faa8db8a0ad342097808a6ae1d80ccb22fea8ed1f1fcd8d9c1c0df01fa10d2ce31e560cf4a399e6b46bd4a1c47849e89f80f288e9625c80b26ee002a6bf64d28abfc6528a8e40e38acee063a69964b3d61ecb4ce6fc352f57fdc550ebc8667f9a6db1df240d5a233049d6a774d52a78f8aa14ffb9925079fad7d7faf5d6e80a7d81535439f497d9bacf97c20a61a66bf459988f8b22deaecd8300619a57304a17be05138b8119bb77e92578146c0822be9012ce486247c785da24b764ea66dfa4cd1a3f8f92427fc8eda3c046a6b4146b3bd929b7c3e55e47cca5a257700553a8f187d8cace27c375761baa49b9bb2f96dd7acca8a3025e48cc67fd65d3bb012ea09c4dce23dd910cbce26e995c307312a10e68e23c3e6ed2a24957074515170b4579a7af8abd46ef9a6296a7e0d25893784a53d154e134b66e413387698545a0d50d2857210fc761270834b457038093172efb7ab411b98406b866d488d9	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}	DXREG.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}\ = 8e2ccc82c331361fe40db77f1aad3043e849c260e7b21a19f677e5559877f15ad4880a27e045963b0451da778ea5623b79692f03dd794c545e464caa8eff0f5290ced0a570bb56967bb5e92700e5e0bb752e2b4221c8db59090b807909d3634611144b4a61febb6d29238461a9abe059394f1742f5ceeb23b9112c87023a10288e4442d8510c0b60815e68f37e262c0abc806ef42298f84812f8bfef12e238d72835a7d7eab587dbba3151d7bbc556e8c45faa8db8a0ad342097808a6ae1d80ccb22fea8ed1f1fcd8d9c1c0df01fa10d2ce31e560cf4a399e6b46bd4a1c47849e89f80f288e9625c80b26ee002a6bf64d28abfc6528a8e40e38acee063a69964b3d61ecb4ce6fc352f57fdc550ebc8667f9a6db1df240d5a233049d6a774d52a78f8aa14ffb9925079fad7d7faf5d6e80a7d81535439f497d9bacf97c20a61a66bf459988f8b22deaecd8300619a57304a17be05138b8119bb77e92578146c0822be9012ce486247c785da24b764ea66dfa4cd1a3f8f92427fc8eda3c046a6b4146b3bd929b7c3e55e47cca5a257700553a8f187d8cace27c375761baa49b9bb2f96dd7acca8a3025e48cc67fd65d3bb012ea09c4dce23dd910cbce26e995c307312a10e68e23c3e6ed2a24957074515170b4579a7af8abd46ef9a62325b01c35893784a53d154e134b66e413387698545a0d50d2857210fc761270834b457038093172efb7ab411b98406b861548760	DXREG.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}\ = 8e2ccc82c331361fe40db77f1aad3043e849c260e7b21a19f677e5559877f15ad4880a27e045963b0451da778ea5623b79692f03dd794c547ae6a07d88ff0f52fd48502670bb56967bb5e92700e5e0bb752e2b4221c8db59090b807909d3634611144b4a61febb6d29238461a9abe059394f1742f5ceeb23b9112c87023a10288e4442d8510c0b60815e68f37e262c0abc806ef42298f84812f8bfef12e238d72835a7d7eab587dbba3151d7bbc556e8c45faa8db8a0ad342097808a6ae1d80ccb22fea8ed1f1fcd8d9c1c0df01fa10d2ce31e560cf4a399e6b46bd4a1c47849e89f80f288e9625c80b26ee002a6bf64d28abfc6528a8e40e38acee063a69964b3d61ecb4ce6fc352f57fdc550ebc8667f9a6db1df240d5a233049d6a774d52a78f8aa14ffb9925079fad7d7faf5d6e80a7d81535439f497d9bacf97c20a61a66bf459988f8b22deaecd8300619a57304a17be05138b8119bb77e92578146c0822be9012ce486247c785da24b764ea66dfa4cd1a3f8f92427fc8eda3c046a6b4146b3bd929b7c3e55e47cca5a257700553a8f187d8cace27c375761baa49b9bb2f96dd7acca8a3025e48cc67fd65d3bb012ea09c4dce23dd910cbce26e995c307312a10e68e23c3e6ed2a24957074515170b4579a7af8abd46ef9a6296a7e0d25893784a53d154e134b66e413387698545a0d50d2857210fc761270834b457038093172efb7ab411b98406b8f75bde9a	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}\ = 8e2ccc82c331361fe40db77f1aad3043e849c260e7b21a19f677e5559877f15ad4880a27e045963b0451da778ea5623b79692f03dd794c545e464caa8fff0f52fd48502670bb56967bb5e92700e5e0bb752e2b4221c8db59090b807909d3634611144b4a61febb6d29238461a9abe059394f1742f5ceeb23b9112c87023a10288e4442d8510c0b60815e68f37e262c0abc806ef42298f84812f8bfef12e238d72835a7d7eab587dbba3151d7bbc556e8c45faa8db8a0ad342097808a6ae1d80ccb22fea8ed1f1fcd8d9c1c0df01fa10d2ce31e560cf4a399e6b46bd4a1c47849e89f80f288e9625c80b26ee002a6bf64d28abfc6528a8e40e38acee063a69964b3d61ecb4ce6fc352f57fdc550ebc8667f9a6db1df240d5a233049d6a774d52a78f8aa14ffb9925079fad7d7faf5d6e80a7d81535439f497d9bacf97c20a61a66bf459988f8b22deaecd8300619a57304a17be05138b8119bb77e92578146c0822be9012ce486247c785da24b764ea66dfa4cd1a3f8f92427fc8eda3c046a6b4146b3bd929b7c3e55e47cca5a257700553a8f187d8cace27c375761baa49b9bb2f96dd7acca8a3025e48cc67fd65d3bb012ea09c4dce23dd910cbce26e995c307312a10e68e23c3e6ed2a24957074515170b4579a7af8abd46ef9a6296a7e0d25893784a53d154e134b66e413387698545a0d50d2857210fc761270834b457038093172efb7ab411b98406b8b12be920	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{0654207A-1C2D0709-3935AB73-E1CF3B0E}\ = 8e2ccc82c331361fe40db77f1aad3043e849c260e7b21a19f677e5559877f15ad4880a27e045963b0451da778ea5623b79692f03dd794c545e464caa8fff0f5290ced0a570bb56967bb5e92700e5e0bb752e2b4221c8db59090b807909d3634611144b4a61febb6d29238461a9abe059394f1742f5ceeb23b9112c87023a10288e4442d8510c0b60815e68f37e262c0abc806ef42298f84812f8bfef12e238d72835a7d7eab587dbba3151d7bbc556e8c45faa8db8a0ad342097808a6ae1d80ccb22fea8ed1f1fcd8d9c1c0df01fa10d2ce31e560cf4a399e6b46bd4a1c47849e89f80f288e9625c80b26ee002a6bf64d28abfc6528a8e40e38acee063a69964b3d61ecb4ce6fc352f57fdc550ebc8667f9a6db1df240d5a233049d6a774d52a78f8aa14ffb9925079fad7d7faf5d6e80a7d81535439f497d9bacf97c20a61a66bf459988f8b22deaecd8300619a57304a17be05138b8119bb77e92578146c0822be9012ce486247c785da24b764ea66dfa4cd1a3f8f92427fc8eda3c046a6b4146b3bd929b7c3e55e47cca5a257700553a8f187d8cace27c375761baa49b9bb2f96dd7acca8a3025e48cc67fd65d3bb012ea09c4dce23dd910cbce26e995c307312a10e68e23c3e6ed2a24957074515170b4579a7af8abd46ef9a62325b01c35893784a53d154e134b66e413387698545a0d50d2857210fc761270834b457038093172efb7ab411b98406b866f436da	DXREG.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}	DXREG.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
4704	DXREG.EXE
4704	DXREG.EXE
4704	DXREG.EXE
4704	DXREG.EXE
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4704	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	79
PID 2208 wrote to memory of 4704	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	79
PID 2208 wrote to memory of 4704	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	79
PID 2208 wrote to memory of 4636	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	80
PID 2208 wrote to memory of 4636	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	80
PID 2208 wrote to memory of 4636	2208	ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe	80

C:\Users\Admin\AppData\Local\Temp\ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe
"C:\Users\Admin\AppData\Local\Temp\ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223.exe"
1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208
- C:\WINDOWS\DXREG.EXE
  C:\WINDOWS\DXREG.EXE
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\nsrkul.bat
  2⤵
  PID:4636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\DXREG.EXE

Filesize
347KB

MD5
bba7d452aae29e5061c8f41ab07d0f1e

SHA1
8da8e1e6c76b783836f18436187fcb9257504904

SHA256
ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223

SHA512
4f4003faa621de6615e970931d86326cc95b89e3b587e20f27b45fd9eeb31222e783245e8607d23b2fa70695722568e1d6953f8c2bdd8a8d98d314741245c514

Download Submit
C:\Windows\PCGWIN32.LI4

Filesize
528B

MD5
cc7ab84fddc48b84c1d81c7642dde4ca

SHA1
cb8731c13b7991dfefa15f92967bc211df579301

SHA256
bdec4b48f7d38cc72c7268da1a35828d0031208731776758274dcbf51cd7e756

SHA512
887fbae4e6aaf2f92ff0bb0633c3408aa61d7e9a4e255ca4574e0eba237086163267dce396b3223f4cda51268dce7eccee6ac8bc1e6196f0c0ad5a920878fc78

Download Submit
C:\Windows\dxreg.exe

Filesize
347KB

MD5
bba7d452aae29e5061c8f41ab07d0f1e

SHA1
8da8e1e6c76b783836f18436187fcb9257504904

SHA256
ce4ef3fbfc08919a16dc8cff25c69f39a260c3aebad708082a65231176080223

SHA512
4f4003faa621de6615e970931d86326cc95b89e3b587e20f27b45fd9eeb31222e783245e8607d23b2fa70695722568e1d6953f8c2bdd8a8d98d314741245c514

Download Submit
\??\c:\NSRKUL.BAT

Filesize
139B

MD5
7686c83d0fe68c2f414d4da3fed2b940

SHA1
4f8630d2bde947dcc16bda2d12e5565f37d4d69b

SHA256
b402b02c167efec945836bfda7d9214d113852c3e9c2d618210aee74cdbbf788

SHA512
0b2af4f89936c444c552149babf1beaf07ecb804db500062b3e850c6910fbfde8477c9e22d8fb1aa4f4bbc0ff71f92b4f7c6a762d4021df9e0d5be7304715c8c

Download Submit
memory/2208-135-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download
memory/2208-132-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2208-134-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2208-144-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download
memory/2208-143-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2208-133-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download
memory/4704-140-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/4704-141-0x0000000000620000-0x0000000000634000-memory.dmp

Filesize
80KB

Download
memory/4704-146-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads