1483ce03b17463c12017853ab9f8c11e496a61289e6fe310f7551aedfe1b74c4

General

Target

41b4a483d0cbedd84770000b3504313d.exe
Size

15KB
MD5

41b4a483d0cbedd84770000b3504313d
SHA1

9d90ff44990b13dfc7d8a966e3b98ca1a5456cc5
SHA256

1483ce03b17463c12017853ab9f8c11e496a61289e6fe310f7551aedfe1b74c4
SHA512

49bdac78845ed67aa2525a1a9bfd6c0391ac6ebb61121ddd754202ab2a6f204ff2305cb920abbc6dc9a13c2bc84922e620ff8fd3844d7e804394429425057ad1
SSDEEP

384:WQouEuiOGSF55ZAT2kco5XszIG5uF03+nuU7E41B:WQo+uSjzj4XCVr3+L7EkB

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	41b4a483d0cbedd84770000b3504313d.exe

Executes dropped EXE 1 IoCs

pid	Process
3260	conlme.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\safety = "C:\\Program Files\\Common Files\\session\\conlme.exe"	mshta.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\session	conlme.exe
File opened for modification	C:\Program Files (x86)\Common Files\session	41b4a483d0cbedd84770000b3504313d.exe
File created	C:\Program Files (x86)\OVS.hta	41b4a483d0cbedd84770000b3504313d.exe
File created	C:\Program Files (x86)\Common Files\session\conlme.exe	41b4a483d0cbedd84770000b3504313d.exe
File opened for modification	C:\Program Files (x86)\Common Files\session\conlme.exe	41b4a483d0cbedd84770000b3504313d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1068	taskkill.exe
5088	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	41b4a483d0cbedd84770000b3504313d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	41b4a483d0cbedd84770000b3504313d.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	3260	conlme.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4804	1104	41b4a483d0cbedd84770000b3504313d.exe	91
PID 1104 wrote to memory of 4804	1104	41b4a483d0cbedd84770000b3504313d.exe	91
PID 1104 wrote to memory of 4804	1104	41b4a483d0cbedd84770000b3504313d.exe	91
PID 1104 wrote to memory of 4632	1104	41b4a483d0cbedd84770000b3504313d.exe	92
PID 1104 wrote to memory of 4632	1104	41b4a483d0cbedd84770000b3504313d.exe	92
PID 1104 wrote to memory of 4632	1104	41b4a483d0cbedd84770000b3504313d.exe	92
PID 1104 wrote to memory of 3220	1104	41b4a483d0cbedd84770000b3504313d.exe	93
PID 1104 wrote to memory of 3220	1104	41b4a483d0cbedd84770000b3504313d.exe	93
PID 1104 wrote to memory of 3220	1104	41b4a483d0cbedd84770000b3504313d.exe	93
PID 3220 wrote to memory of 1068	3220	cmd.exe	96
PID 3220 wrote to memory of 1068	3220	cmd.exe	96
PID 3220 wrote to memory of 1068	3220	cmd.exe	96
PID 4632 wrote to memory of 5088	4632	cmd.exe	97
PID 4632 wrote to memory of 5088	4632	cmd.exe	97
PID 4632 wrote to memory of 5088	4632	cmd.exe	97
PID 1104 wrote to memory of 3260	1104	41b4a483d0cbedd84770000b3504313d.exe	99
PID 1104 wrote to memory of 3260	1104	41b4a483d0cbedd84770000b3504313d.exe	99
PID 1104 wrote to memory of 3260	1104	41b4a483d0cbedd84770000b3504313d.exe	99
PID 1104 wrote to memory of 3144	1104	41b4a483d0cbedd84770000b3504313d.exe	101
PID 1104 wrote to memory of 3144	1104	41b4a483d0cbedd84770000b3504313d.exe	101
PID 1104 wrote to memory of 3144	1104	41b4a483d0cbedd84770000b3504313d.exe	101

C:\Users\Admin\AppData\Local\Temp\41b4a483d0cbedd84770000b3504313d.exe
"C:\Users\Admin\AppData\Local\Temp\41b4a483d0cbedd84770000b3504313d.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\OVS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im cfmon.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im cfmon.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im conlme.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im conlme.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\Program Files (x86)\Common Files\session\conlme.exe
  "C:\Program Files (x86)\Common Files\session\conlme.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\41b4a483d0cbedd84770000b3504313d.exe"
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\session\conlme.exe

Filesize
3.1MB

MD5
e6f212afcbe2adbc87178c7b1db0a804

SHA1
48384014a8b17fc63d8a6a705d510b4aa9b1bc5c

SHA256
02ab273d32ce3c1b7a13cb762871302f95017000107d8bea731016e8655a88d3

SHA512
e80b4a27d9fe73f7cf40d804cb4fb797c160a094a372ebba7079286ace4aae0986a46407daf95dee22df73856ff399731922a9d9e08d6d3c9ac5c13ff807b6ad

Download Submit
C:\Program Files (x86)\Common Files\session\conlme.exe

Filesize
4.7MB

MD5
aeb134b42c454837da0caf8be744d5f6

SHA1
caac0493117a48adaa2643781865b8ea1a9be198

SHA256
7853ce44aa42c72aa0dddb69cfc7f2213312284b356aa23d6978d907582b0a2b

SHA512
e1bad12252e96cbd6485b739f1f76b6a80f1229f8fe125bf20e302166109ccb3a2c14b9fc72ed28142b66bc1d7d32d9cf829c50320d30c465153212cdd88aff3

Download Submit
C:\Program Files (x86)\OVS.hta

Filesize
799B

MD5
c7504050738d7e7c49ae38b325c6ddf9

SHA1
f1e4de627782cdaf76e4ef797ed2d8778f05fa00

SHA256
a0ee5fb73b97dadaf54b31db5452c83ddef349f04c50cba00d50d3bcd6a102da

SHA512
affc9e1cc5d7b53613738049110618f999f6307e802a66dfd42368c78f03fe82d5a4cdaba35ee8e1e341456a005f59b67f48435dbe865696a7b9275c1ec4b0d7

Download Submit
memory/1104-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1104-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1104-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3260-10-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3260-12-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads