863aa5c5903b8a6c48e38b91a5047a069dfa0121b232b55ae53565580a27e93d

General

Target

5bed002693c8d51253162b847dcb52b9.exe
Size

860KB
MD5

5bed002693c8d51253162b847dcb52b9
SHA1

54a4b4a01858d13722c1813cd146c92936bde327
SHA256

863aa5c5903b8a6c48e38b91a5047a069dfa0121b232b55ae53565580a27e93d
SHA512

0420fc446fc72451ed180a9afc7d58c43f71d1667c7c1607c220500d0035f23a1f36d38e5c46573e6c2e3cb841fb419a003994a84ba6d60cba6afc7372b18eea
SSDEEP

24576:b1VUfLibdQTQzbQNxAdBbklQzqPE+k/SSsmwD7:BeTi6svQN6T4VEXKShQ7

Score

8^/10

persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Executes dropped EXE 1 IoCs

pid	Process
2832	b5be18b3.exe

Loads dropped DLL 6 IoCs

pid	Process
1752	5bed002693c8d51253162b847dcb52b9.exe
2832	b5be18b3.exe
2832	b5be18b3.exe
2832	b5be18b3.exe
2832	b5be18b3.exe
2832	b5be18b3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ccfgnt32 = "rundll32.exe ccfgnt32.dll,igib"	5bed002693c8d51253162b847dcb52b9.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ccfgnt32.dll	5bed002693c8d51253162b847dcb52b9.exe
File opened for modification	C:\Windows\SysWOW64\838bc6e1.dll	5bed002693c8d51253162b847dcb52b9.exe
File created	C:\Windows\SysWOW64\GLBSINST.%$D	b5be18b3.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1920	sc.exe
2356	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1920	1752	5bed002693c8d51253162b847dcb52b9.exe	28
PID 1752 wrote to memory of 1920	1752	5bed002693c8d51253162b847dcb52b9.exe	28
PID 1752 wrote to memory of 1920	1752	5bed002693c8d51253162b847dcb52b9.exe	28
PID 1752 wrote to memory of 1920	1752	5bed002693c8d51253162b847dcb52b9.exe	28
PID 1752 wrote to memory of 2356	1752	5bed002693c8d51253162b847dcb52b9.exe	30
PID 1752 wrote to memory of 2356	1752	5bed002693c8d51253162b847dcb52b9.exe	30
PID 1752 wrote to memory of 2356	1752	5bed002693c8d51253162b847dcb52b9.exe	30
PID 1752 wrote to memory of 2356	1752	5bed002693c8d51253162b847dcb52b9.exe	30
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32
PID 1752 wrote to memory of 2832	1752	5bed002693c8d51253162b847dcb52b9.exe	32

C:\Users\Admin\AppData\Local\Temp\5bed002693c8d51253162b847dcb52b9.exe
"C:\Users\Admin\AppData\Local\Temp\5bed002693c8d51253162b847dcb52b9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ccfgnt32 type= share start= auto DisplayName= "Internet Configuration Library" group= "Event Log" binPath= "rundll32.exe C:\Windows\system32\ccfgnt32.dll,igib"
  2⤵
  - Launches sc.exe
  PID:1920
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ccfgnt32 "Internet Configuration Library"
  2⤵
  - Launches sc.exe
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\b5be18b3.exe
  "C:\Users\Admin\AppData\Local\Temp\b5be18b3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLC13CF.tmp

Filesize
157KB

MD5
fbd929bfc7b4a9e4fa4506655bab4c4a

SHA1
b4df84de80729a04ed90dc976a3e730a568f24f8

SHA256
adf8dea5d36b58cf621e2bb0c4549f94e0919308dd7cc1215d942417c45e54a4

SHA512
b310e79848dc2a3c6a4524e0b120e2e3dd73ecb6852c65a9eec368045f7bab0b141210726476dd3cb0c1d9008e1f34149f35c03a0156a9eef7d4a7fbc61ea1b4

Download Submit
\Users\Admin\AppData\Local\Temp\GLK13DF.tmp

Filesize
30KB

MD5
3df61e5730883b2d338addd7acbe4bc4

SHA1
03166e6230231e7e3583cf9c8944f4967aa1bf1b

SHA256
2efe9a54c8eb878711d9b6cd18f276838645aff52fe69d8a864376cb258ec616

SHA512
36e9d705d22dad3d952b4da578a990f2b63ec2f9fbf2734efdaea9ecbd4f07a8d7232792eb5bdd81c553354d51334993cb6103c377f3483a680eac9e41cd2087

Download Submit
\Users\Admin\AppData\Local\Temp\b5be18b3.exe

Filesize
795KB

MD5
f0dee2a8a9730ae0ed70aa5d0d1bbd74

SHA1
1905a834598459a0f88d12fdfd6a1d893c43449b

SHA256
8cc5e834e7ff983f9312826611435a2d80f7703bc208402c4f62954c270ae692

SHA512
5673b16ae28dc0f53cb47ce675bf51ce9bff12e8503f33274cd20145a9487b271cc8975fa7bd63b443a4cd1436693d5976546efa0329b927e3fbf8155584ec29

Download Submit
memory/1752-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1752-21-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads