863aa5c5903b8a6c48e38b91a5047a069dfa0121b232b55ae53565580a27e93d

General

Target

5bed002693c8d51253162b847dcb52b9.exe
Size

860KB
MD5

5bed002693c8d51253162b847dcb52b9
SHA1

54a4b4a01858d13722c1813cd146c92936bde327
SHA256

863aa5c5903b8a6c48e38b91a5047a069dfa0121b232b55ae53565580a27e93d
SHA512

0420fc446fc72451ed180a9afc7d58c43f71d1667c7c1607c220500d0035f23a1f36d38e5c46573e6c2e3cb841fb419a003994a84ba6d60cba6afc7372b18eea
SSDEEP

24576:b1VUfLibdQTQzbQNxAdBbklQzqPE+k/SSsmwD7:BeTi6svQN6T4VEXKShQ7

Score

8^/10

persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	5bed002693c8d51253162b847dcb52b9.exe

Executes dropped EXE 1 IoCs

pid	Process
3340	4fe41b4a.exe

Loads dropped DLL 3 IoCs

pid	Process
3340	4fe41b4a.exe
3340	4fe41b4a.exe
3340	4fe41b4a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ccfgnt32 = "rundll32.exe ccfgnt32.dll,igib"	5bed002693c8d51253162b847dcb52b9.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ccfgnt32.dll	5bed002693c8d51253162b847dcb52b9.exe
File opened for modification	C:\Windows\SysWOW64\1db1c978.dll	5bed002693c8d51253162b847dcb52b9.exe
File opened for modification	C:\Windows\SysWOW64\36e8c587.dll	5bed002693c8d51253162b847dcb52b9.exe
File created	C:\Windows\SysWOW64\GLBSINST.%$D	4fe41b4a.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
536	sc.exe
3084	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 536	3552	5bed002693c8d51253162b847dcb52b9.exe	87
PID 3552 wrote to memory of 536	3552	5bed002693c8d51253162b847dcb52b9.exe	87
PID 3552 wrote to memory of 536	3552	5bed002693c8d51253162b847dcb52b9.exe	87
PID 3552 wrote to memory of 3084	3552	5bed002693c8d51253162b847dcb52b9.exe	89
PID 3552 wrote to memory of 3084	3552	5bed002693c8d51253162b847dcb52b9.exe	89
PID 3552 wrote to memory of 3084	3552	5bed002693c8d51253162b847dcb52b9.exe	89
PID 3552 wrote to memory of 3340	3552	5bed002693c8d51253162b847dcb52b9.exe	92
PID 3552 wrote to memory of 3340	3552	5bed002693c8d51253162b847dcb52b9.exe	92
PID 3552 wrote to memory of 3340	3552	5bed002693c8d51253162b847dcb52b9.exe	92

C:\Users\Admin\AppData\Local\Temp\5bed002693c8d51253162b847dcb52b9.exe
"C:\Users\Admin\AppData\Local\Temp\5bed002693c8d51253162b847dcb52b9.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ccfgnt32 type= share start= auto DisplayName= "Internet Configuration Library" group= "Event Log" binPath= "rundll32.exe C:\Windows\system32\ccfgnt32.dll,igib"
  2⤵
  - Launches sc.exe
  PID:536
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ccfgnt32 "Internet Configuration Library"
  2⤵
  - Launches sc.exe
  PID:3084
- C:\Users\Admin\AppData\Local\Temp\4fe41b4a.exe
  "C:\Users\Admin\AppData\Local\Temp\4fe41b4a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4fe41b4a.exe

Filesize
150KB

MD5
fdc81d7277b6f244a6a6d045b1f9ed89

SHA1
e929fbae6b877af7fe1b9bb3c54cc72dbd6409fe

SHA256
e9cd4ec87d2bf18e43f88b95138714bf964cbf8b012f06a797be49311ef1c5ef

SHA512
5e3f6c53b44ba0a6dfc88471479ea2c44a19fc55490d9a6f95c426953869ba8861d87c66d399b1f68a985c403b645d3880303e8e99e10f0920c277138b75f41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fe41b4a.exe

Filesize
795KB

MD5
f0dee2a8a9730ae0ed70aa5d0d1bbd74

SHA1
1905a834598459a0f88d12fdfd6a1d893c43449b

SHA256
8cc5e834e7ff983f9312826611435a2d80f7703bc208402c4f62954c270ae692

SHA512
5673b16ae28dc0f53cb47ce675bf51ce9bff12e8503f33274cd20145a9487b271cc8975fa7bd63b443a4cd1436693d5976546efa0329b927e3fbf8155584ec29

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLC6AD0.tmp

Filesize
157KB

MD5
fbd929bfc7b4a9e4fa4506655bab4c4a

SHA1
b4df84de80729a04ed90dc976a3e730a568f24f8

SHA256
adf8dea5d36b58cf621e2bb0c4549f94e0919308dd7cc1215d942417c45e54a4

SHA512
b310e79848dc2a3c6a4524e0b120e2e3dd73ecb6852c65a9eec368045f7bab0b141210726476dd3cb0c1d9008e1f34149f35c03a0156a9eef7d4a7fbc61ea1b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK6AFF.tmp

Filesize
30KB

MD5
3df61e5730883b2d338addd7acbe4bc4

SHA1
03166e6230231e7e3583cf9c8944f4967aa1bf1b

SHA256
2efe9a54c8eb878711d9b6cd18f276838645aff52fe69d8a864376cb258ec616

SHA512
36e9d705d22dad3d952b4da578a990f2b63ec2f9fbf2734efdaea9ecbd4f07a8d7232792eb5bdd81c553354d51334993cb6103c377f3483a680eac9e41cd2087

Download Submit
memory/3552-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3552-33-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads