55caca52abf37a49b12a02e66216185dce838bb0222921647148ee495c1d1c08

General

Target

c4bd87c3284cab7b4a4d4039af0f933e.exe
Size

428KB
MD5

c4bd87c3284cab7b4a4d4039af0f933e
SHA1

f99fbf47be97d05942aaa7de443ee60d1fde7c30
SHA256

55caca52abf37a49b12a02e66216185dce838bb0222921647148ee495c1d1c08
SHA512

8d8ba14128507d03cf67c88b676763038bb631579ba981ba43e83e807c6250ea6ca3e5d1db30f2e4162515236b0f4940a08100b511a78ccced8506d11ae6accd
SSDEEP

12288:B7tb3KcX80ljcF82LnZ84bd4zRrnKorz:dtmOjYZdbdilj

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c4bd87c3284cab7b4a4d4039af0f933e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	c4bd87c3284cab7b4a4d4039af0f933e.exe

Executes dropped EXE 2 IoCs

Processes:

TIEGHZKC55.exeWinSec.exe

pid process

3316 TIEGHZKC55.exe
3716 WinSec.exe
Loads dropped DLL 1 IoCs

Processes:

WinSec.exe

pid process

3716 WinSec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

TIEGHZKC55.exe

description pid process target process

PID 3316 set thread context of 3716 3316 TIEGHZKC55.exe WinSec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3316	TIEGHZKC55.exe
3716	WinSec.exe

pid	process
3716	WinSec.exe

description	pid	process	target process
PID 3316 set thread context of 3716	3316	TIEGHZKC55.exe	WinSec.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

WinSec.exe

description	pid	process
Token: 1	3716	WinSec.exe
Token: SeCreateTokenPrivilege	3716	WinSec.exe
Token: SeAssignPrimaryTokenPrivilege	3716	WinSec.exe
Token: SeLockMemoryPrivilege	3716	WinSec.exe
Token: SeIncreaseQuotaPrivilege	3716	WinSec.exe
Token: SeMachineAccountPrivilege	3716	WinSec.exe
Token: SeTcbPrivilege	3716	WinSec.exe
Token: SeSecurityPrivilege	3716	WinSec.exe
Token: SeTakeOwnershipPrivilege	3716	WinSec.exe
Token: SeLoadDriverPrivilege	3716	WinSec.exe
Token: SeSystemProfilePrivilege	3716	WinSec.exe
Token: SeSystemtimePrivilege	3716	WinSec.exe
Token: SeProfSingleProcessPrivilege	3716	WinSec.exe
Token: SeIncBasePriorityPrivilege	3716	WinSec.exe
Token: SeCreatePagefilePrivilege	3716	WinSec.exe
Token: SeCreatePermanentPrivilege	3716	WinSec.exe
Token: SeBackupPrivilege	3716	WinSec.exe
Token: SeRestorePrivilege	3716	WinSec.exe
Token: SeShutdownPrivilege	3716	WinSec.exe
Token: SeDebugPrivilege	3716	WinSec.exe
Token: SeAuditPrivilege	3716	WinSec.exe
Token: SeSystemEnvironmentPrivilege	3716	WinSec.exe
Token: SeChangeNotifyPrivilege	3716	WinSec.exe
Token: SeRemoteShutdownPrivilege	3716	WinSec.exe
Token: SeUndockPrivilege	3716	WinSec.exe
Token: SeSyncAgentPrivilege	3716	WinSec.exe
Token: SeEnableDelegationPrivilege	3716	WinSec.exe
Token: SeManageVolumePrivilege	3716	WinSec.exe
Token: SeImpersonatePrivilege	3716	WinSec.exe
Token: SeCreateGlobalPrivilege	3716	WinSec.exe
Token: 31	3716	WinSec.exe
Token: 32	3716	WinSec.exe
Token: 33	3716	WinSec.exe
Token: 34	3716	WinSec.exe
Token: 35	3716	WinSec.exe
Token: SeDebugPrivilege	3716	WinSec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WinSec.exe

pid process

3716 WinSec.exe
3716 WinSec.exe

pid	process
3716	WinSec.exe
3716	WinSec.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

c4bd87c3284cab7b4a4d4039af0f933e.exeTIEGHZKC55.exe

description	pid	process	target process
PID 3728 wrote to memory of 3316	3728	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 3728 wrote to memory of 3316	3728	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 3728 wrote to memory of 3316	3728	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe
PID 3316 wrote to memory of 3716	3316	TIEGHZKC55.exe	WinSec.exe

C:\Users\Admin\AppData\Local\Temp\c4bd87c3284cab7b4a4d4039af0f933e.exe
"C:\Users\Admin\AppData\Local\Temp\c4bd87c3284cab7b4a4d4039af0f933e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe
"C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3316

C:\Users\Admin\AppData\Roaming\WinSec.exe
C:\Users\Admin\AppData\Roaming\WinSec.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe
Filesize
276KB

MD5
441d047bd699525d4e3268e25e16e1b8

SHA1
65d9070ef5ba0f8dea0face8f3a2c8525111d63e

SHA256
cbbf088b87bb798c35e955281026571835656d25c75aa6a994b9fb89e6070bfe

SHA512
3717bcf2e929da78b8b1b62e78f81a7171c050ea0fa948f587a7a2ab02a32446d573c613f019df6206461aa7fdc6b4b6fc15a0ce9f58a5438e0b319ed46d7a28

Download Submit
C:\Users\Admin\AppData\Roaming\WinSec.exe
Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/3316-18-0x0000000001A60000-0x0000000001A70000-memory.dmp

Filesize
64KB

Download
memory/3316-19-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3316-28-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3316-17-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3716-36-0x0000000076FD0000-0x00000000770C0000-memory.dmp

Filesize
960KB

Download
memory/3716-23-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3716-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3716-37-0x0000000076300000-0x000000007637A000-memory.dmp

Filesize
488KB

Download
memory/3716-38-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3716-44-0x0000000076FD0000-0x00000000770C0000-memory.dmp

Filesize
960KB

Download
memory/3728-16-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3728-1-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3728-0-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3728-2-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads