a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3

General

Target

a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
Size

128KB
MD5

e2692be2304f0bbda1f0a8aa7b1f1425
SHA1

8fb6f1fd24f99f026819495144c71c482447ff5a
SHA256

a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3
SHA512

228be8500b06d132a643102e8eb7aa75396656c00d88ebad2635f9d42e72c293e45b4983d2ac3db93f8f9b75a99da86752a59298aea7b5b41bed1ae874f34e61
SSDEEP

3072:lOH978j70e4e9PxIoPNV3B2GOH978j70e4et:lU9UtHLBvU9Utp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4424	REldnQ.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4960-132-0x0000000000800000-0x0000000000818000-memory.dmp	upx
behavioral2/files/0x0006000000022e6f-134.dat	upx
behavioral2/files/0x0006000000022e6f-135.dat	upx
behavioral2/memory/4960-138-0x0000000000800000-0x0000000000818000-memory.dmp	upx
behavioral2/memory/4424-141-0x0000000000800000-0x0000000000818000-memory.dmp	upx
behavioral2/memory/4424-142-0x0000000000800000-0x0000000000818000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SoftWare\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	REldnQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0123456 = "C:\\Program Files (x86)\\Common Files\\System\\ado\\REldnQ.exe"	REldnQ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\REldnQ.exebnb	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\RCXB77D.tmp	REldnQ.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\application\92.0.902.67\installer\lpk.dll	REldnQ.exe
File created	\??\c:\program files\google\chrome\application\89.0.4389.114\installer\lpk.dll	REldnQ.exe
File created	\??\c:\program files (x86)\microsoft\edge\application\92.0.902.67\installer\lpk.dll	REldnQ.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\REldnQ.exe	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
File created	C:\Program Files (x86)\Common Files\System\ado\REldnQ.exebnb	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
File created	C:\Program Files (x86)\Common Files\System\ado\admin.obj	REldnQ.exe
File opened for modification	\??\c:\program files\google\chrome\application\89.0.4389.114\installer\lpk.dll	REldnQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2132	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4424	REldnQ.exe
4424	REldnQ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
Token: SeDebugPrivilege	4424	REldnQ.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4424	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	80
PID 4960 wrote to memory of 4424	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	80
PID 4960 wrote to memory of 4424	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	80
PID 4960 wrote to memory of 4120	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	81
PID 4960 wrote to memory of 4120	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	81
PID 4960 wrote to memory of 4120	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	81
PID 4960 wrote to memory of 4140	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	82
PID 4960 wrote to memory of 4140	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	82
PID 4960 wrote to memory of 4140	4960	a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe	82
PID 4140 wrote to memory of 2132	4140	cmd.exe	86
PID 4140 wrote to memory of 2132	4140	cmd.exe	86
PID 4140 wrote to memory of 2132	4140	cmd.exe	86
PID 4120 wrote to memory of 2580	4120	cmd.exe	85
PID 4120 wrote to memory of 2580	4120	cmd.exe	85
PID 4120 wrote to memory of 2580	4120	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe
"C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Common Files\System\ado\REldnQ.exe
  "C:\Program Files (x86)\Common Files\System\ado\REldnQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /A:RHSA "C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe"&cmd /c del "C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe"
    3⤵
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping -n 2 127.0.0.1>nul&del /F /Q /A : RSAH "C:\Users\Admin\AppData\Local\Temp\a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\ado\REldnQ.exe

Filesize
128KB

MD5
e2692be2304f0bbda1f0a8aa7b1f1425

SHA1
8fb6f1fd24f99f026819495144c71c482447ff5a

SHA256
a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3

SHA512
228be8500b06d132a643102e8eb7aa75396656c00d88ebad2635f9d42e72c293e45b4983d2ac3db93f8f9b75a99da86752a59298aea7b5b41bed1ae874f34e61

Download Submit
C:\Program Files (x86)\Common Files\System\ado\REldnQ.exe

Filesize
128KB

MD5
e2692be2304f0bbda1f0a8aa7b1f1425

SHA1
8fb6f1fd24f99f026819495144c71c482447ff5a

SHA256
a686427c8e168672e6e6a7879411301566fd6c7a2f0204486ec9ddfde767ffe3

SHA512
228be8500b06d132a643102e8eb7aa75396656c00d88ebad2635f9d42e72c293e45b4983d2ac3db93f8f9b75a99da86752a59298aea7b5b41bed1ae874f34e61

Download Submit
memory/4424-141-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/4424-142-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/4960-132-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/4960-138-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing