cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291

General

Target
cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Size 1.8MB
Sample240309-rd5n2aac21
SHA256 cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291
MD5 708cc3ae1a1320de92bd3c1d94f3394c
SHA1 44c086a83f5c3e0b16e25a5ab04663882252b406
SHA512 8a9f2b80c606732edec0d649167d0040409fe32ad78156f0da61edf402b46d5126419ab879e79d0fc43224d079ba0f4292b520d931e17a462e413c5863c9f313
SSDEEP 49152:zi39+084E6W4W8Vm/hD49aXZmMA8GadWb0/Rat9nD:G+HVb4W8QR49unDQ+gf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2544	sg.tmp
2584	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
2584	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeRestorePrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeCreateGlobalPrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeRestorePrivilege	2544	sg.tmp
Token: 35	2544	sg.tmp
Token: SeSecurityPrivilege	2544	sg.tmp
Token: SeSecurityPrivilege	2544	sg.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2088	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	28
PID 1584 wrote to memory of 2088	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	28
PID 1584 wrote to memory of 2088	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	28
PID 1584 wrote to memory of 2088	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	28
PID 1584 wrote to memory of 2544	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	30
PID 1584 wrote to memory of 2544	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	30
PID 1584 wrote to memory of 2544	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	30
PID 1584 wrote to memory of 2544	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	30
PID 1584 wrote to memory of 2584	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	32
PID 1584 wrote to memory of 2584	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	32
PID 1584 wrote to memory of 2584	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	32
PID 1584 wrote to memory of 2584	1584	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	32

C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
"C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\~6355580385764013047~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~2728839388792578799"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\~2728839388792578799\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~2728839388792578799\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_elf.dll

Path \Users\Admin\AppData\Local\Temp\~2728839388792578799\msedge_elf.dll
Size 26KB
SHA256 2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2
MD5 457f1e9754479c07bfa7925fd743bdfa
SHA1 d2c99cca4749da75f5b3dd624943e425205f3828
SHA512 11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9
SSDEEP 768:GUnfIzUia6ZOXoRxGyFC75apCsBrvbwfqZ:jgzJZO0/FDpCurzwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Users\Admin\AppData\Local\Temp\~2728839388792578799\svchost.exe
Size 833KB
SHA256 7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b
MD5 9a25c9f4ae1ae0206d0ac670fc26bfb0
SHA1 ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5
SHA512 ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1
SSDEEP 24576:oasTmsTDNwvFTDTJZhRK1T+Bda9td41kGZFF:PUYTDTy1be1rFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sg.tmp

Path \Users\Admin\AppData\Local\Temp\~6355580385764013047~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads