c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2

General

Target

c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe
Size

128KB
MD5

b4cf040161c1062f412e9a575ba6dd99
SHA1

1cb7f980a4854b3c5896aade5e3417e65f7690d0
SHA256

c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2
SHA512

7513d96cb0a470c27476fe99a9ab7f004f3861c8502bea2180026569ca4a13e25fb356fccaaf6e0469ad078fc61e481826a32d6f13c292ef55ec02f69aa7b96e
SSDEEP

3072:Dv5efMpNc+lQVlW/hXXXdIpXXXXXXXXXXXXXX7ig/Nl2lPXXXXXXXXXXXXXXXiXO:TJpDpXXXdIpXXXXXXXXXXXXXX1l2JXXb

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1952	syshost.exe

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1740	netsh.exe
1340	netsh.exe
1472	netsh.exe
1056	netsh.exe

Deletes itself 1 IoCs

pid	Process
944	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.231.81.244
Destination IP	106.187.47.17
Destination IP	94.231.81.244
Destination IP	94.231.81.244

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	syshost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe
File opened for modification	C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe
File opened for modification	C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe.tmp	syshost.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	syshost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	syshost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1376	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1952	syshost.exe
Token: SeIncreaseQuotaPrivilege	1952	syshost.exe
Token: SeShutdownPrivilege	1952	syshost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 944	1376	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe	27
PID 1376 wrote to memory of 944	1376	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe	27
PID 1376 wrote to memory of 944	1376	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe	27
PID 1376 wrote to memory of 944	1376	c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe	27
PID 1952 wrote to memory of 1740	1952	syshost.exe	29
PID 1952 wrote to memory of 1740	1952	syshost.exe	29
PID 1952 wrote to memory of 1740	1952	syshost.exe	29
PID 1952 wrote to memory of 1740	1952	syshost.exe	29
PID 1952 wrote to memory of 1340	1952	syshost.exe	31
PID 1952 wrote to memory of 1340	1952	syshost.exe	31
PID 1952 wrote to memory of 1340	1952	syshost.exe	31
PID 1952 wrote to memory of 1340	1952	syshost.exe	31
PID 1952 wrote to memory of 1472	1952	syshost.exe	32
PID 1952 wrote to memory of 1472	1952	syshost.exe	32
PID 1952 wrote to memory of 1472	1952	syshost.exe	32
PID 1952 wrote to memory of 1472	1952	syshost.exe	32
PID 1952 wrote to memory of 1056	1952	syshost.exe	35
PID 1952 wrote to memory of 1056	1952	syshost.exe	35
PID 1952 wrote to memory of 1056	1952	syshost.exe	35
PID 1952 wrote to memory of 1056	1952	syshost.exe	35

C:\Users\Admin\AppData\Local\Temp\c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe
"C:\Users\Admin\AppData\Local\Temp\c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\fdea2b6a.tmp"
  2⤵
  - Deletes itself
  PID:944

C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe
"C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:1340
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe

Filesize
128KB

MD5
b4cf040161c1062f412e9a575ba6dd99

SHA1
1cb7f980a4854b3c5896aade5e3417e65f7690d0

SHA256
c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2

SHA512
7513d96cb0a470c27476fe99a9ab7f004f3861c8502bea2180026569ca4a13e25fb356fccaaf6e0469ad078fc61e481826a32d6f13c292ef55ec02f69aa7b96e

Download Submit
C:\Windows\Installer\{7ABEA90B-BDFC-71F4-A177-BE2081345627}\syshost.exe

Filesize
128KB

MD5
b4cf040161c1062f412e9a575ba6dd99

SHA1
1cb7f980a4854b3c5896aade5e3417e65f7690d0

SHA256
c000680bdb3ce344fbf4fe7339778d50fb8f30e919489d12c4792576b9cb23c2

SHA512
7513d96cb0a470c27476fe99a9ab7f004f3861c8502bea2180026569ca4a13e25fb356fccaaf6e0469ad078fc61e481826a32d6f13c292ef55ec02f69aa7b96e

Download Submit
memory/944-61-0x0000000000000000-mapping.dmp

Download
memory/1056-71-0x0000000000000000-mapping.dmp

Download
memory/1340-67-0x0000000000000000-mapping.dmp

Download
memory/1376-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1376-58-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1376-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1376-54-0x00000000002B0000-0x00000000002B9000-memory.dmp

Filesize
36KB

Download
memory/1376-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1472-68-0x0000000000000000-mapping.dmp

Download
memory/1740-65-0x0000000000000000-mapping.dmp

Download
memory/1952-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1952-64-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing