Resubmissions
18/09/2023, 11:22
230918-ngklgsgh6w 818/09/2023, 11:20
230918-nfx57agh51 718/09/2023, 04:17
230918-ewdbaaeh8s 3Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 11:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LCALPC.exe
Resource
win7-20230831-en
windows7-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
LCALPC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
19 signatures
600 seconds
General
-
Target
LCALPC.exe
-
Size
3.3MB
-
MD5
4c268a0c963b7809565ce22c296a8c79
-
SHA1
8c218f1d34d56a4feae367e019c958175286c993
-
SHA256
112a0ff26e12fdd7fd499eec86d2050fa12eb5d9a74ec9f5cfc820c676f88409
-
SHA512
1e6372a932832e4df14adb7d584fce6d594571354d753af597a46f60936d4d492543d07f3158c3c4b85dd8303300095d090b28b08426415c0305bd06b095f851
-
SSDEEP
49152:XX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QB:XlRsZ47/QXoHUOfAoj1x6B
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " LCALPC.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation LCALPC.exe -
Executes dropped EXE 1 IoCs
pid Process 1776 MeshAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\ED96C522A8465752DCBE4FD65D1C20D42727D659 MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\0DCE1EF3A933645E939CDCE39FFD68D536AF32DA MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCC463DBD558BC3AA1CADA3D891F2FA9AA26F06 MeshAgent.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.msh MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.exe LCALPC.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133395097484275484" MeshAgent.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4260 taskmgr.exe 2256 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4664 wmic.exe Token: SeSecurityPrivilege 4664 wmic.exe Token: SeTakeOwnershipPrivilege 4664 wmic.exe Token: SeLoadDriverPrivilege 4664 wmic.exe Token: SeSystemProfilePrivilege 4664 wmic.exe Token: SeSystemtimePrivilege 4664 wmic.exe Token: SeProfSingleProcessPrivilege 4664 wmic.exe Token: SeIncBasePriorityPrivilege 4664 wmic.exe Token: SeCreatePagefilePrivilege 4664 wmic.exe Token: SeBackupPrivilege 4664 wmic.exe Token: SeRestorePrivilege 4664 wmic.exe Token: SeShutdownPrivilege 4664 wmic.exe Token: SeDebugPrivilege 4664 wmic.exe Token: SeSystemEnvironmentPrivilege 4664 wmic.exe Token: SeRemoteShutdownPrivilege 4664 wmic.exe Token: SeUndockPrivilege 4664 wmic.exe Token: SeManageVolumePrivilege 4664 wmic.exe Token: 33 4664 wmic.exe Token: 34 4664 wmic.exe Token: 35 4664 wmic.exe Token: 36 4664 wmic.exe Token: SeIncreaseQuotaPrivilege 4664 wmic.exe Token: SeSecurityPrivilege 4664 wmic.exe Token: SeTakeOwnershipPrivilege 4664 wmic.exe Token: SeLoadDriverPrivilege 4664 wmic.exe Token: SeSystemProfilePrivilege 4664 wmic.exe Token: SeSystemtimePrivilege 4664 wmic.exe Token: SeProfSingleProcessPrivilege 4664 wmic.exe Token: SeIncBasePriorityPrivilege 4664 wmic.exe Token: SeCreatePagefilePrivilege 4664 wmic.exe Token: SeBackupPrivilege 4664 wmic.exe Token: SeRestorePrivilege 4664 wmic.exe Token: SeShutdownPrivilege 4664 wmic.exe Token: SeDebugPrivilege 4664 wmic.exe Token: SeSystemEnvironmentPrivilege 4664 wmic.exe Token: SeRemoteShutdownPrivilege 4664 wmic.exe Token: SeUndockPrivilege 4664 wmic.exe Token: SeManageVolumePrivilege 4664 wmic.exe Token: 33 4664 wmic.exe Token: 34 4664 wmic.exe Token: 35 4664 wmic.exe Token: 36 4664 wmic.exe Token: SeDebugPrivilege 4260 taskmgr.exe Token: SeSystemProfilePrivilege 4260 taskmgr.exe Token: SeCreateGlobalPrivilege 4260 taskmgr.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe Token: SeIncBasePriorityPrivilege 2256 mmc.exe Token: 33 2256 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2256 mmc.exe 2256 mmc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1276 wrote to memory of 4664 1276 LCALPC.exe 86 PID 1276 wrote to memory of 4664 1276 LCALPC.exe 86 PID 1276 wrote to memory of 3352 1276 LCALPC.exe 92 PID 1276 wrote to memory of 3352 1276 LCALPC.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LCALPC.exe"C:\Users\Admin\AppData\Local\Temp\LCALPC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\LCALPC.exe"C:\Users\Admin\AppData\Local\Temp\LCALPC.exe" -fullinstall2⤵
- Sets service image path in registry
- Drops file in Program Files directory
PID:3352
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1776
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1560
-
C:\Windows\System32\lykac0.exe"C:\Windows\System32\lykac0.exe"1⤵PID:3796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:484
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD54c268a0c963b7809565ce22c296a8c79
SHA18c218f1d34d56a4feae367e019c958175286c993
SHA256112a0ff26e12fdd7fd499eec86d2050fa12eb5d9a74ec9f5cfc820c676f88409
SHA5121e6372a932832e4df14adb7d584fce6d594571354d753af597a46f60936d4d492543d07f3158c3c4b85dd8303300095d090b28b08426415c0305bd06b095f851
-
Filesize
3.3MB
MD54c268a0c963b7809565ce22c296a8c79
SHA18c218f1d34d56a4feae367e019c958175286c993
SHA256112a0ff26e12fdd7fd499eec86d2050fa12eb5d9a74ec9f5cfc820c676f88409
SHA5121e6372a932832e4df14adb7d584fce6d594571354d753af597a46f60936d4d492543d07f3158c3c4b85dd8303300095d090b28b08426415c0305bd06b095f851