14edc7e17f0f54eb4c750ef54e79b7241b77094ffe6d39f2a7e6d5583dead4b0

General

Target

11ea1cac1b6a156f34248849aa7907cb.exe
Size

522KB
MD5

11ea1cac1b6a156f34248849aa7907cb
SHA1

8c11db6b05f2878e263279296e8105136baebb92
SHA256

14edc7e17f0f54eb4c750ef54e79b7241b77094ffe6d39f2a7e6d5583dead4b0
SHA512

624f2f6ceebab94d66475403d4f0ccb116ac317f586b017a8c64b80caa6fa2fcfe8a324b6b5a5a6797dc9958ae41d4ed4fefe8915058b88d1131e53a19a365e0
SSDEEP

12288:wMgDksy9lYyxFSMZQ+peBI+lkHQ4jC9FfmiqZZ4C8+db:vH3YyxFhZ8rKHXcFf5qECJb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\i4i.exe = "C:\\Users\\Admin\\AppData\\Roaming\\i4i.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe = "C:\\Users\\Admin\\AppData\\Roaming\\SerbianPersia\\SerbianPersia.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Executes dropped EXE 2 IoCs

Processes:

SerbianPersia.exeSerbianPersia.exe

pid process

2956 SerbianPersia.exe
1192 SerbianPersia.exe

pid	process
2956	SerbianPersia.exe
1192	SerbianPersia.exe

Loads dropped DLL 5 IoCs

Processes:

11ea1cac1b6a156f34248849aa7907cb.exe

pid	process
2688	11ea1cac1b6a156f34248849aa7907cb.exe
2688	11ea1cac1b6a156f34248849aa7907cb.exe
2688	11ea1cac1b6a156f34248849aa7907cb.exe
2688	11ea1cac1b6a156f34248849aa7907cb.exe
2688	11ea1cac1b6a156f34248849aa7907cb.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2688-0-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe	upx
behavioral1/memory/2956-38-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral1/memory/2688-39-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral1/memory/1192-43-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-46-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-48-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2956-47-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral1/memory/1192-54-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-55-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-56-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-58-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-59-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-62-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-64-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1192-66-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\SerbianPersian = "C:\\Users\\Admin\\AppData\\Roaming\\SerbianPersia\\SerbianPersia.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SerbianPersia.exe

description pid process target process

PID 2956 set thread context of 1192 2956 SerbianPersia.exe SerbianPersia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1644 reg.exe
2392 reg.exe
1772 reg.exe
2908 reg.exe

description	pid	process	target process
PID 2956 set thread context of 1192	2956	SerbianPersia.exe	SerbianPersia.exe

pid	process
1644	reg.exe
2392	reg.exe
1772	reg.exe
2908	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

SerbianPersia.exe

description	pid	process
Token: 1	1192	SerbianPersia.exe
Token: SeCreateTokenPrivilege	1192	SerbianPersia.exe
Token: SeAssignPrimaryTokenPrivilege	1192	SerbianPersia.exe
Token: SeLockMemoryPrivilege	1192	SerbianPersia.exe
Token: SeIncreaseQuotaPrivilege	1192	SerbianPersia.exe
Token: SeMachineAccountPrivilege	1192	SerbianPersia.exe
Token: SeTcbPrivilege	1192	SerbianPersia.exe
Token: SeSecurityPrivilege	1192	SerbianPersia.exe
Token: SeTakeOwnershipPrivilege	1192	SerbianPersia.exe
Token: SeLoadDriverPrivilege	1192	SerbianPersia.exe
Token: SeSystemProfilePrivilege	1192	SerbianPersia.exe
Token: SeSystemtimePrivilege	1192	SerbianPersia.exe
Token: SeProfSingleProcessPrivilege	1192	SerbianPersia.exe
Token: SeIncBasePriorityPrivilege	1192	SerbianPersia.exe
Token: SeCreatePagefilePrivilege	1192	SerbianPersia.exe
Token: SeCreatePermanentPrivilege	1192	SerbianPersia.exe
Token: SeBackupPrivilege	1192	SerbianPersia.exe
Token: SeRestorePrivilege	1192	SerbianPersia.exe
Token: SeShutdownPrivilege	1192	SerbianPersia.exe
Token: SeDebugPrivilege	1192	SerbianPersia.exe
Token: SeAuditPrivilege	1192	SerbianPersia.exe
Token: SeSystemEnvironmentPrivilege	1192	SerbianPersia.exe
Token: SeChangeNotifyPrivilege	1192	SerbianPersia.exe
Token: SeRemoteShutdownPrivilege	1192	SerbianPersia.exe
Token: SeUndockPrivilege	1192	SerbianPersia.exe
Token: SeSyncAgentPrivilege	1192	SerbianPersia.exe
Token: SeEnableDelegationPrivilege	1192	SerbianPersia.exe
Token: SeManageVolumePrivilege	1192	SerbianPersia.exe
Token: SeImpersonatePrivilege	1192	SerbianPersia.exe
Token: SeCreateGlobalPrivilege	1192	SerbianPersia.exe
Token: 31	1192	SerbianPersia.exe
Token: 32	1192	SerbianPersia.exe
Token: 33	1192	SerbianPersia.exe
Token: 34	1192	SerbianPersia.exe
Token: 35	1192	SerbianPersia.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

11ea1cac1b6a156f34248849aa7907cb.exeSerbianPersia.exeSerbianPersia.exe

pid process

2688 11ea1cac1b6a156f34248849aa7907cb.exe
2956 SerbianPersia.exe
1192 SerbianPersia.exe
1192 SerbianPersia.exe
1192 SerbianPersia.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

11ea1cac1b6a156f34248849aa7907cb.execmd.exeSerbianPersia.exeSerbianPersia.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2688 wrote to memory of 2760	2688	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2688 wrote to memory of 2760	2688	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2688 wrote to memory of 2760	2688	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2688 wrote to memory of 2760	2688	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2760 wrote to memory of 2732	2760	cmd.exe	reg.exe
PID 2760 wrote to memory of 2732	2760	cmd.exe	reg.exe
PID 2760 wrote to memory of 2732	2760	cmd.exe	reg.exe
PID 2760 wrote to memory of 2732	2760	cmd.exe	reg.exe
PID 2688 wrote to memory of 2956	2688	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2688 wrote to memory of 2956	2688	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2688 wrote to memory of 2956	2688	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2688 wrote to memory of 2956	2688	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 2956 wrote to memory of 1192	2956	SerbianPersia.exe	SerbianPersia.exe
PID 1192 wrote to memory of 1324	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1324	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1324	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1324	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1632	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1632	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1632	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 1632	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2648	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2648	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2648	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2648	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2124	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2124	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2124	1192	SerbianPersia.exe	cmd.exe
PID 1192 wrote to memory of 2124	1192	SerbianPersia.exe	cmd.exe
PID 1324 wrote to memory of 1644	1324	cmd.exe	reg.exe
PID 1324 wrote to memory of 1644	1324	cmd.exe	reg.exe
PID 1324 wrote to memory of 1644	1324	cmd.exe	reg.exe
PID 1324 wrote to memory of 1644	1324	cmd.exe	reg.exe
PID 1632 wrote to memory of 2392	1632	cmd.exe	reg.exe
PID 1632 wrote to memory of 2392	1632	cmd.exe	reg.exe
PID 1632 wrote to memory of 2392	1632	cmd.exe	reg.exe
PID 1632 wrote to memory of 2392	1632	cmd.exe	reg.exe
PID 2124 wrote to memory of 1772	2124	cmd.exe	reg.exe
PID 2124 wrote to memory of 1772	2124	cmd.exe	reg.exe
PID 2124 wrote to memory of 1772	2124	cmd.exe	reg.exe
PID 2124 wrote to memory of 1772	2124	cmd.exe	reg.exe
PID 2648 wrote to memory of 2908	2648	cmd.exe	reg.exe
PID 2648 wrote to memory of 2908	2648	cmd.exe	reg.exe
PID 2648 wrote to memory of 2908	2648	cmd.exe	reg.exe
PID 2648 wrote to memory of 2908	2648	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\11ea1cac1b6a156f34248849aa7907cb.exe
"C:\Users\Admin\AppData\Local\Temp\11ea1cac1b6a156f34248849aa7907cb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\259444467.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SerbianPersian" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /f
3⤵
- Adds Run key to start application
PID:2732

C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
"C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
"C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2392

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\i4i.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\i4i.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1772

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259444467.bat
Filesize
161B

MD5
fd6ff0018e5f38a1f58149ab5042d0bf

SHA1
ead83b25ace051ba0215997f54e1a5b72b33e112

SHA256
da8ef51f8e28c04cefe22ec5e08569de5cd64a984d35b4cd9b9cfab0218bf6ce

SHA512
21b2500fac940978b1d606f321dc120c33b910822b96b4a5a1c0ebd8584e207a39961d1bb7ad833112a5832d56c1a2acd0491b3b62bde8c3648296886353a256

Download Submit
C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
Filesize
522KB

MD5
1125d22adfbc45db8730321c0791a8f0

SHA1
213513bcc8eb3f7ae498d0131efe01544add52d2

SHA256
5aa263d00b5e1ee174bd300eceb7f58ad00e5281e97636ce8626c5a677f03c48

SHA512
9314400973e4708f437469db0c2e3cfc56ea5e61903edbed9637120114114da9ebcd28ae0dd6ae40913f0910768fe3b1040d8c6ee1e12c761de27cbe3b247b69

Download Submit
memory/1192-55-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-54-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-66-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-64-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-62-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-43-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-46-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-48-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-59-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-58-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1192-56-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2688-0-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/2688-37-0x0000000003CB0000-0x0000000003E5F000-memory.dmp

Filesize
1.7MB

Download
memory/2688-39-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/2688-36-0x0000000003CB0000-0x0000000003E5F000-memory.dmp

Filesize
1.7MB

Download
memory/2956-47-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/2956-38-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads