2be652d5bf6494a329b2a1087b7c8d27030c974d69a115924466a217d5cee517

General

Target

0dbf4a53a709516a9c1c362fd727b7ef.exe
Size

649KB
MD5

0dbf4a53a709516a9c1c362fd727b7ef
SHA1

bdc9a44903c006b3b86797e715f46d3930365e79
SHA256

2be652d5bf6494a329b2a1087b7c8d27030c974d69a115924466a217d5cee517
SHA512

1a5c010df670ce162c574616c9a7a9309e09d3efbedf3a7846c9420a7dbb8c59a375348828cc16b93b9fbf4e88db401dd37ea322a1b57f71d2fbbcd98ed4486e
SSDEEP

12288:gREX7F/rNTTCY1ZfFZueHVtxnW7xRypQLR2+huboz:gRO7lP1ZdfH9wRcQLR2bUz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	0dbf4a53a709516a9c1c362fd727b7ef.exe

Executes dropped EXE 1 IoCs

pid	Process
708	svchoct.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inf\scsys16_080930.dll	0dbf4a53a709516a9c1c362fd727b7ef.exe
File created	C:\Windows\SysWOW64\inf\svchoct.exe	0dbf4a53a709516a9c1c362fd727b7ef.exe
File opened for modification	C:\Windows\SysWOW64\inf\svchoct.exe	0dbf4a53a709516a9c1c362fd727b7ef.exe
File created	C:\Windows\SysWOW64\inf\sppdcrs080930.scr	0dbf4a53a709516a9c1c362fd727b7ef.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tawisys.ini	0dbf4a53a709516a9c1c362fd727b7ef.exe
File created	C:\Windows\system\sgcxcxxaspf080930.exe	0dbf4a53a709516a9c1c362fd727b7ef.exe
File created	C:\Windows\dcbdcatys32_080930a.dll	0dbf4a53a709516a9c1c362fd727b7ef.exe
File created	C:\Windows\wftadfi16_080930a.dll	0dbf4a53a709516a9c1c362fd727b7ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
848	0dbf4a53a709516a9c1c362fd727b7ef.exe
848	0dbf4a53a709516a9c1c362fd727b7ef.exe
848	0dbf4a53a709516a9c1c362fd727b7ef.exe
848	0dbf4a53a709516a9c1c362fd727b7ef.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	0dbf4a53a709516a9c1c362fd727b7ef.exe
Token: SeDebugPrivilege	848	0dbf4a53a709516a9c1c362fd727b7ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 708	848	0dbf4a53a709516a9c1c362fd727b7ef.exe	94
PID 848 wrote to memory of 708	848	0dbf4a53a709516a9c1c362fd727b7ef.exe	94
PID 848 wrote to memory of 708	848	0dbf4a53a709516a9c1c362fd727b7ef.exe	94

C:\Users\Admin\AppData\Local\Temp\0dbf4a53a709516a9c1c362fd727b7ef.exe
"C:\Users\Admin\AppData\Local\Temp\0dbf4a53a709516a9c1c362fd727b7ef.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\inf\svchoct.exe
  "C:\Windows\system32\inf\svchoct.exe" C:\Windows\wftadfi16_080930a.dll tan16d
  2⤵
  - Executes dropped EXE
  PID:708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "c:\myls3tecj.bat"
    3⤵
    PID:2972

C:\Windows\system\sgcxcxxaspf080930.exe
"C:\Windows\system\sgcxcxxaspf080930.exe" i
1⤵
PID:4512
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3756
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3756 CREDAT:17410 /prefetch:2
    3⤵
    PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\dcbdcatys32_080930a.dll

Filesize
565KB

MD5
b825cdfc50282d44bf34b91d4663aede

SHA1
0fd1bfccb6a751b5bb196ca523d98f5faabf1d3e

SHA256
df37f85c00d53538f059152aa985624610b7a4b0371fff6108619f3d51c57977

SHA512
43da88cd81d336bf2d7f7cf68bfd85039cf72de733a7733ca0661e97098817651bf0f746c61860fea7553ceae37e0a0dd2042b725c2401aeefedef957d29f23b

Download Submit
C:\Windows\tawisys.ini

Filesize
112B

MD5
c7697d9b324a4770a053eea20949c059

SHA1
8f6670c6f96445cfb5361851fbb212a7d92aada4

SHA256
f7407cddaa48975d904334fa9eeb1aef231a97249c38f8442776b9882fa67e90

SHA512
4db7e8ad5d4bd380b14be2aeed34553693a49aa89fda707fce9b6bbbe74e7a1b111c7aa7ac41ce4336e3de0e101f7870b4674fc095250b3d25d2063a21c93063

Download Submit
C:\Windows\tawisys.ini

Filesize
460B

MD5
f0347fb28ea1f4a7e1eb6ec9551019d0

SHA1
4ad3cfefc77710b83dde84394df28cd27ddf9052

SHA256
fd13671e9b50bf4cfd7c44652ee3b13e4ddb466ae3caf2581a1b2883dfaf3ff4

SHA512
8944a9ac00390d69ab61d65a4dbebbbc5de6ae4767cfe42081c9c202c52c24e6d2abbf6264f8bdd1cee235bdad686d3dc70850c61ee3ece340daff9019d6a23a

Download Submit
C:\Windows\tawisys.ini

Filesize
487B

MD5
edc1e20e41c649851ebd0f325b2c7f84

SHA1
7e1f5e9498bec2957e6a3aa6f945cfa5f197dc08

SHA256
ef9120e5e532c9b7ec546d469a703fa13346e14df18575a761a8c48714708004

SHA512
02ea8bba9f70ff651afd82e7d5f96bf427b453c73f35126c095123d8f90d607ae7cccdd783dbb0e6184be3421a4efe7f209522ac424a63b763a37b22b7956861

Download Submit
memory/708-70-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/708-95-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/708-121-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/848-54-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4512-77-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4512-85-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4512-92-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing