Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 06:59
Behavioral task
behavioral1
Sample
abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe
Resource
win7-20230831-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe
-
Size
271KB
-
MD5
18d84d594f51a6651fb81fe481e34253
-
SHA1
c30c28a892b172f36b8ba136ade6312c394cc3e9
-
SHA256
abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da
-
SHA512
2a5791910bf9e7bc48bc7a033d6359a008cf93c5bd8337463ef4de3358edcd27b5022a7ae45e6d6fe986a9c56eba2e1eb958e50434b0cf899c33eef429fd1aa9
-
SSDEEP
6144:Gl51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa:OqXUHkUXe3GOkx2LIa
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3228 created 596 3228 Explorer.EXE 5 -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\nPMPNFe.sys dialer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe -
Executes dropped EXE 2 IoCs
pid Process 4764 68235dd8 3740 dialer.exe -
resource yara_rule behavioral2/memory/5112-0-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/files/0x00070000000231d1-3.dat upx behavioral2/files/0x00070000000231d1-2.dat upx behavioral2/memory/4764-4-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral2/memory/5112-30-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/5112-32-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/4764-39-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral2/memory/4764-68-0x00000000002E0000-0x0000000000369000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 -
Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B dialer.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B dialer.exe File created C:\Windows\SysWOW64\68235dd8 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 dialer.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C dialer.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 68235dd8 File created C:\Windows\system32\ \Windows\System32\hQdaYp6B.sys dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 68235dd8 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 dialer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4 68235dd8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 68235dd8 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\518fb8 68235dd8 File created C:\Windows\Help\dialer.exe Explorer.EXE File opened for modification C:\Windows\Help\dialer.exe Explorer.EXE File created C:\Windows\CGMttfc.sys dialer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dialer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName dialer.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 4312 timeout.exe 5076 timeout.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dialer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dialer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" dialer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 68235dd8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 68235dd8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dialer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 68235dd8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 68235dd8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dialer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dialer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 68235dd8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 68235dd8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 68235dd8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 68235dd8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dialer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 68235dd8 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 4764 68235dd8 3228 Explorer.EXE 3228 Explorer.EXE 3228 Explorer.EXE 3228 Explorer.EXE 4764 68235dd8 4764 68235dd8 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe 3740 dialer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 Explorer.EXE -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe Token: SeTcbPrivilege 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe Token: SeDebugPrivilege 4764 68235dd8 Token: SeTcbPrivilege 4764 68235dd8 Token: SeDebugPrivilege 4764 68235dd8 Token: SeDebugPrivilege 3228 Explorer.EXE Token: SeDebugPrivilege 3228 Explorer.EXE Token: SeIncBasePriorityPrivilege 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe Token: SeDebugPrivilege 4764 68235dd8 Token: SeDebugPrivilege 3740 dialer.exe Token: SeDebugPrivilege 3740 dialer.exe Token: SeDebugPrivilege 3740 dialer.exe Token: SeShutdownPrivilege 3228 Explorer.EXE Token: SeCreatePagefilePrivilege 3228 Explorer.EXE Token: SeIncBasePriorityPrivilege 4764 68235dd8 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3228 Explorer.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3228 4764 68235dd8 45 PID 4764 wrote to memory of 3228 4764 68235dd8 45 PID 4764 wrote to memory of 3228 4764 68235dd8 45 PID 4764 wrote to memory of 3228 4764 68235dd8 45 PID 4764 wrote to memory of 3228 4764 68235dd8 45 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 3228 wrote to memory of 3740 3228 Explorer.EXE 91 PID 4764 wrote to memory of 596 4764 68235dd8 5 PID 4764 wrote to memory of 596 4764 68235dd8 5 PID 4764 wrote to memory of 596 4764 68235dd8 5 PID 4764 wrote to memory of 596 4764 68235dd8 5 PID 4764 wrote to memory of 596 4764 68235dd8 5 PID 5112 wrote to memory of 2468 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe 94 PID 5112 wrote to memory of 2468 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe 94 PID 5112 wrote to memory of 2468 5112 abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe 94 PID 2468 wrote to memory of 4312 2468 cmd.exe 96 PID 2468 wrote to memory of 4312 2468 cmd.exe 96 PID 2468 wrote to memory of 4312 2468 cmd.exe 96 PID 4764 wrote to memory of 5004 4764 68235dd8 99 PID 4764 wrote to memory of 5004 4764 68235dd8 99 PID 4764 wrote to memory of 5004 4764 68235dd8 99 PID 5004 wrote to memory of 5076 5004 cmd.exe 100 PID 5004 wrote to memory of 5076 5004 cmd.exe 100 PID 5004 wrote to memory of 5076 5004 cmd.exe 100
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:596
-
C:\Windows\Help\dialer.exe"C:\Windows\Help\dialer.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe"C:\Users\Admin\AppData\Local\Temp\abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\abafe3257cc419959314880b4ddb2fc30e32d82e5dfcf9d327fa8c1d4d3913da.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:4312
-
-
-
-
C:\Windows\Syswow64\68235dd8C:\Windows\Syswow64\68235dd81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\68235dd8"2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\timeout.exetimeout /t 13⤵
- Delays execution with timeout.exe
PID:5076
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.6MB
MD55244c87dbafa1f764b258766005dea73
SHA184cb8b4fb3e0910cfecfb31b6fa54c16d940e703
SHA256077035f93ddc3ac5a8b5631d43826baf7722256eb1c4716b3c2567f07379bc40
SHA51254d64d32e73e2752cdf9a110db17ad64574eb072df0ed0dc34a7e4bc469c03aa79ef7d45465e279ef85d5fc6b33a1b750b181476cdea7ea98898ddba9aa60438
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
271KB
MD5a6e120e96e52b2c9b57eaebc3ecd3238
SHA1a4e7b0ce655546bdf7085799a9d90fdccab234f0
SHA256fb7dd68a1fd91994adaf7955fcde17f5ab5c955ee0d8b96e6018edcc1c817563
SHA5122871af39de4a0c54923e7349fa4b0d1604553f5544620e6b35c5866a414392b3654698f381b77d282927ba72ffe57310defb986d1a247e2a4a8d4f42b5cc8d3d
-
Filesize
271KB
MD5a6e120e96e52b2c9b57eaebc3ecd3238
SHA1a4e7b0ce655546bdf7085799a9d90fdccab234f0
SHA256fb7dd68a1fd91994adaf7955fcde17f5ab5c955ee0d8b96e6018edcc1c817563
SHA5122871af39de4a0c54923e7349fa4b0d1604553f5544620e6b35c5866a414392b3654698f381b77d282927ba72ffe57310defb986d1a247e2a4a8d4f42b5cc8d3d