14edc7e17f0f54eb4c750ef54e79b7241b77094ffe6d39f2a7e6d5583dead4b0

General

Target

11ea1cac1b6a156f34248849aa7907cb.exe
Size

522KB
MD5

11ea1cac1b6a156f34248849aa7907cb
SHA1

8c11db6b05f2878e263279296e8105136baebb92
SHA256

14edc7e17f0f54eb4c750ef54e79b7241b77094ffe6d39f2a7e6d5583dead4b0
SHA512

624f2f6ceebab94d66475403d4f0ccb116ac317f586b017a8c64b80caa6fa2fcfe8a324b6b5a5a6797dc9958ae41d4ed4fefe8915058b88d1131e53a19a365e0
SSDEEP

12288:wMgDksy9lYyxFSMZQ+peBI+lkHQ4jC9FfmiqZZ4C8+db:vH3YyxFhZ8rKHXcFf5qECJb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\i4i.exe = "C:\\Users\\Admin\\AppData\\Roaming\\i4i.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe = "C:\\Users\\Admin\\AppData\\Roaming\\SerbianPersia\\SerbianPersia.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

11ea1cac1b6a156f34248849aa7907cb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	11ea1cac1b6a156f34248849aa7907cb.exe

Executes dropped EXE 2 IoCs

Processes:

SerbianPersia.exeSerbianPersia.exe

pid process

5116 SerbianPersia.exe
956 SerbianPersia.exe

pid	process
5116	SerbianPersia.exe
956	SerbianPersia.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2920-0-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe	upx
behavioral2/memory/5116-20-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral2/memory/2920-19-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral2/memory/956-24-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/5116-28-0x0000000000400000-0x00000000005AF000-memory.dmp	upx
behavioral2/memory/956-27-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-29-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-35-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-36-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-37-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-40-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-41-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-43-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-44-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-45-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-48-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-49-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/956-52-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SerbianPersian = "C:\\Users\\Admin\\AppData\\Roaming\\SerbianPersia\\SerbianPersia.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SerbianPersia.exe

description pid process target process

PID 5116 set thread context of 956 5116 SerbianPersia.exe SerbianPersia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1008 reg.exe
3900 reg.exe
1628 reg.exe
4140 reg.exe

description	pid	process	target process
PID 5116 set thread context of 956	5116	SerbianPersia.exe	SerbianPersia.exe

pid	process
1008	reg.exe
3900	reg.exe
1628	reg.exe
4140	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

SerbianPersia.exe

description	pid	process
Token: 1	956	SerbianPersia.exe
Token: SeCreateTokenPrivilege	956	SerbianPersia.exe
Token: SeAssignPrimaryTokenPrivilege	956	SerbianPersia.exe
Token: SeLockMemoryPrivilege	956	SerbianPersia.exe
Token: SeIncreaseQuotaPrivilege	956	SerbianPersia.exe
Token: SeMachineAccountPrivilege	956	SerbianPersia.exe
Token: SeTcbPrivilege	956	SerbianPersia.exe
Token: SeSecurityPrivilege	956	SerbianPersia.exe
Token: SeTakeOwnershipPrivilege	956	SerbianPersia.exe
Token: SeLoadDriverPrivilege	956	SerbianPersia.exe
Token: SeSystemProfilePrivilege	956	SerbianPersia.exe
Token: SeSystemtimePrivilege	956	SerbianPersia.exe
Token: SeProfSingleProcessPrivilege	956	SerbianPersia.exe
Token: SeIncBasePriorityPrivilege	956	SerbianPersia.exe
Token: SeCreatePagefilePrivilege	956	SerbianPersia.exe
Token: SeCreatePermanentPrivilege	956	SerbianPersia.exe
Token: SeBackupPrivilege	956	SerbianPersia.exe
Token: SeRestorePrivilege	956	SerbianPersia.exe
Token: SeShutdownPrivilege	956	SerbianPersia.exe
Token: SeDebugPrivilege	956	SerbianPersia.exe
Token: SeAuditPrivilege	956	SerbianPersia.exe
Token: SeSystemEnvironmentPrivilege	956	SerbianPersia.exe
Token: SeChangeNotifyPrivilege	956	SerbianPersia.exe
Token: SeRemoteShutdownPrivilege	956	SerbianPersia.exe
Token: SeUndockPrivilege	956	SerbianPersia.exe
Token: SeSyncAgentPrivilege	956	SerbianPersia.exe
Token: SeEnableDelegationPrivilege	956	SerbianPersia.exe
Token: SeManageVolumePrivilege	956	SerbianPersia.exe
Token: SeImpersonatePrivilege	956	SerbianPersia.exe
Token: SeCreateGlobalPrivilege	956	SerbianPersia.exe
Token: 31	956	SerbianPersia.exe
Token: 32	956	SerbianPersia.exe
Token: 33	956	SerbianPersia.exe
Token: 34	956	SerbianPersia.exe
Token: 35	956	SerbianPersia.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

11ea1cac1b6a156f34248849aa7907cb.exeSerbianPersia.exeSerbianPersia.exe

pid process

2920 11ea1cac1b6a156f34248849aa7907cb.exe
5116 SerbianPersia.exe
956 SerbianPersia.exe
956 SerbianPersia.exe
956 SerbianPersia.exe

pid	process
2920	11ea1cac1b6a156f34248849aa7907cb.exe
5116	SerbianPersia.exe
956	SerbianPersia.exe
956	SerbianPersia.exe
956	SerbianPersia.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

11ea1cac1b6a156f34248849aa7907cb.execmd.exeSerbianPersia.exeSerbianPersia.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2920 wrote to memory of 5008	2920	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2920 wrote to memory of 5008	2920	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 2920 wrote to memory of 5008	2920	11ea1cac1b6a156f34248849aa7907cb.exe	cmd.exe
PID 5008 wrote to memory of 1688	5008	cmd.exe	reg.exe
PID 5008 wrote to memory of 1688	5008	cmd.exe	reg.exe
PID 5008 wrote to memory of 1688	5008	cmd.exe	reg.exe
PID 2920 wrote to memory of 5116	2920	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2920 wrote to memory of 5116	2920	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 2920 wrote to memory of 5116	2920	11ea1cac1b6a156f34248849aa7907cb.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 5116 wrote to memory of 956	5116	SerbianPersia.exe	SerbianPersia.exe
PID 956 wrote to memory of 3568	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 3568	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 3568	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 2976	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 2976	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 2976	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1636	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1636	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1636	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1596	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1596	956	SerbianPersia.exe	cmd.exe
PID 956 wrote to memory of 1596	956	SerbianPersia.exe	cmd.exe
PID 1636 wrote to memory of 4140	1636	cmd.exe	reg.exe
PID 1636 wrote to memory of 4140	1636	cmd.exe	reg.exe
PID 1636 wrote to memory of 4140	1636	cmd.exe	reg.exe
PID 1596 wrote to memory of 1008	1596	cmd.exe	reg.exe
PID 1596 wrote to memory of 1008	1596	cmd.exe	reg.exe
PID 1596 wrote to memory of 1008	1596	cmd.exe	reg.exe
PID 2976 wrote to memory of 3900	2976	cmd.exe	reg.exe
PID 2976 wrote to memory of 3900	2976	cmd.exe	reg.exe
PID 2976 wrote to memory of 3900	2976	cmd.exe	reg.exe
PID 3568 wrote to memory of 1628	3568	cmd.exe	reg.exe
PID 3568 wrote to memory of 1628	3568	cmd.exe	reg.exe
PID 3568 wrote to memory of 1628	3568	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\11ea1cac1b6a156f34248849aa7907cb.exe
"C:\Users\Admin\AppData\Local\Temp\11ea1cac1b6a156f34248849aa7907cb.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240618281.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SerbianPersian" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /f
3⤵
- Adds Run key to start application
PID:1688

C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
"C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
"C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\i4i.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\i4i.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\i4i.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1008

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:4140

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3900

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240618281.bat
Filesize
161B

MD5
fd6ff0018e5f38a1f58149ab5042d0bf

SHA1
ead83b25ace051ba0215997f54e1a5b72b33e112

SHA256
da8ef51f8e28c04cefe22ec5e08569de5cd64a984d35b4cd9b9cfab0218bf6ce

SHA512
21b2500fac940978b1d606f321dc120c33b910822b96b4a5a1c0ebd8584e207a39961d1bb7ad833112a5832d56c1a2acd0491b3b62bde8c3648296886353a256

Download Submit
C:\Users\Admin\AppData\Roaming\SerbianPersia\SerbianPersia.exe
Filesize
522KB

MD5
1125d22adfbc45db8730321c0791a8f0

SHA1
213513bcc8eb3f7ae498d0131efe01544add52d2

SHA256
5aa263d00b5e1ee174bd300eceb7f58ad00e5281e97636ce8626c5a677f03c48

SHA512
9314400973e4708f437469db0c2e3cfc56ea5e61903edbed9637120114114da9ebcd28ae0dd6ae40913f0910768fe3b1040d8c6ee1e12c761de27cbe3b247b69

Download Submit
memory/956-36-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-37-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-52-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-24-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-49-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-27-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-29-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-35-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-48-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-45-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-40-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-41-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-43-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/956-44-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2920-0-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/2920-19-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/5116-20-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/5116-28-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads