29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767

General

Target

29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
Size

4.6MB
MD5

2c27f8b23713f9f09c739c357acb0460
SHA1

2d65de48fe639f6654d35531a2338b07479480cf
SHA256

29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767
SHA512

72e0bd698f8b4315f3d3fec6791fc157d0a57a122126c570e9500664d8fde8e436ea9e172111205215eb3227e07527b2687d9878b6d22c58c8369fe4ea5eaa0d
SSDEEP

49152:wuggGi/lG4uUoNGGhls1Mt9CiFjrdXqGXOr0U2NLx3GsVG1yXax5KL5d:BgBi/lG4uUiCYgelUcxWKGQaf2

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe

Executes dropped EXE 1 IoCs

pid	Process
4124	AliIN.exe

Loads dropped DLL 3 IoCs

pid	Process
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4544-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-8-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-10-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-14-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-16-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-22-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-24-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-26-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-28-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-30-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-32-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-34-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-36-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-38-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-40-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-42-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-44-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4544-73-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\WINDOWS\AliIN.exe	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2788	4544	WerFault.exe	83
216	4544	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2484	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe
4124	AliIN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4124	4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe	86
PID 4544 wrote to memory of 4124	4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe	86
PID 4544 wrote to memory of 4124	4544	29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe	86

C:\Users\Admin\AppData\Local\Temp\29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe
"C:\Users\Admin\AppData\Local\Temp\29cf333fc901d7b18ee5473d99dd03cb150029f593f52e9fcba221381202c767.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544
- C:\WINDOWS\AliIN.exe
  "C:\WINDOWS\AliIN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1752
  2⤵
  - Program crash
  PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1772
  2⤵
  - Program crash
  PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4544 -ip 4544
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4544 -ip 4544
1⤵
PID:3160

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
cba933625bfa502fc4a1d9f34e1e4473

SHA1
5319194388c0e53321f99f1541b97af191999a09

SHA256
25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

SHA512
f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
cba933625bfa502fc4a1d9f34e1e4473

SHA1
5319194388c0e53321f99f1541b97af191999a09

SHA256
25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

SHA512
f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
638e737b2293cf7b1f14c0b4fb1f3289

SHA1
f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

SHA256
baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

SHA512
4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

Download Submit
C:\WINDOWS\AliIN.exe

Filesize
1.5MB

MD5
38b9c7e6dc6cfce90e01e186bdfb9ac8

SHA1
ed25d5cbaa5c497b1077f86997bfe032a6eb87db

SHA256
c56f550293d497e17e975db6d11a77c10404b985dcebe748211f4dcf18eaefcd

SHA512
ee3b717af8ede191bd5c5c89184daea078bfcfb350f0deaf522e1c16eb928e36f8914eefaefa39131c35b285f22fccf3f44d4a2bbf916fd01e3dffb4819c85b0

Download Submit
C:\Windows\AliIN.exe

Filesize
1.5MB

MD5
38b9c7e6dc6cfce90e01e186bdfb9ac8

SHA1
ed25d5cbaa5c497b1077f86997bfe032a6eb87db

SHA256
c56f550293d497e17e975db6d11a77c10404b985dcebe748211f4dcf18eaefcd

SHA512
ee3b717af8ede191bd5c5c89184daea078bfcfb350f0deaf522e1c16eb928e36f8914eefaefa39131c35b285f22fccf3f44d4a2bbf916fd01e3dffb4819c85b0

Download Submit
C:\Windows\AliIN.exe

Filesize
1.5MB

MD5
38b9c7e6dc6cfce90e01e186bdfb9ac8

SHA1
ed25d5cbaa5c497b1077f86997bfe032a6eb87db

SHA256
c56f550293d497e17e975db6d11a77c10404b985dcebe748211f4dcf18eaefcd

SHA512
ee3b717af8ede191bd5c5c89184daea078bfcfb350f0deaf522e1c16eb928e36f8914eefaefa39131c35b285f22fccf3f44d4a2bbf916fd01e3dffb4819c85b0

Download Submit
memory/2484-75-0x000001E259940000-0x000001E259950000-memory.dmp

Filesize
64KB

Download
memory/4124-74-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4124-69-0x00000000023A0000-0x00000000023E4000-memory.dmp

Filesize
272KB

Download
memory/4124-58-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4544-14-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-42-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-22-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-24-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-26-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-28-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-30-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-32-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-34-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-36-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-38-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-40-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-44-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-16-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-10-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-8-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-73-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4544-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing