Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 13:35
Behavioral task
behavioral1
Sample
e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe
Resource
win7-20240215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe
-
Size
193KB
-
MD5
e1ca5ed8fef91bc4f7fcadb33b0db1d4
-
SHA1
b7270b17986bed82066e8781628d78ed7715c20c
-
SHA256
97b121ada0e870a58919aaf3fcde9884f95b18d28acdff44f7fa864930a789ed
-
SHA512
fd01b9c7a62f9440417d8e792e2a99c4fd384383ba264c40f6f28c413bab81cbedeaad82d91e5f14690225e2de9324dc7530b8992a4111c4ded3a69c3811a2f8
-
SSDEEP
3072:VwqxiTYlCM+v+mkz9gwbm02tPZOojYnrCQvOcL5MtBML4MPr5IsPM9c:VwqiYlCsma9ga2TjYnJOcLavYXD
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Common Files\\System\\secuers32.exe" e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\secdrv.sys e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation secuers32.exe -
Executes dropped EXE 2 IoCs
pid Process 3196 secuers32.exe 4260 server32.exe -
resource yara_rule behavioral2/memory/4676-0-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/files/0x0004000000022c47-8.dat upx behavioral2/memory/4260-14-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4676-15-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/3196-16-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4260-17-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/3196-40-0x0000000000400000-0x0000000000469000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\Smars.sys e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe File created C:\Program Files\Common Files\System\secuers32.exe e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe File opened for modification C:\Program Files\Common Files\System\secuers32.exe e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe File created C:\Program Files\Common Files\System\server32.exe e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe File opened for modification C:\Program Files\Common Files\System\server32.exe e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe File created C:\Program Files\Common Files\System\Smars.sys e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\inf\icuc32.dll secuers32.exe File created \??\c:\windows\inf\icuc32.dll secuers32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe Token: SeDebugPrivilege 3196 secuers32.exe Token: SeDebugPrivilege 3196 secuers32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 3196 secuers32.exe 3196 secuers32.exe 4260 server32.exe 4260 server32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3196 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 92 PID 4676 wrote to memory of 3196 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 92 PID 4676 wrote to memory of 3196 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 92 PID 4676 wrote to memory of 4260 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 93 PID 4676 wrote to memory of 4260 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 93 PID 4676 wrote to memory of 4260 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 93 PID 4676 wrote to memory of 4488 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 94 PID 4676 wrote to memory of 4488 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 94 PID 4676 wrote to memory of 4488 4676 e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe 94 PID 3196 wrote to memory of 2252 3196 secuers32.exe 110 PID 3196 wrote to memory of 2252 3196 secuers32.exe 110 PID 3196 wrote to memory of 2252 3196 secuers32.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe"C:\Users\Admin\AppData\Local\Temp\e1ca5ed8fef91bc4f7fcadb33b0db1d4.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Common Files\System\secuers32.exe"C:\Program Files\Common Files\System\secuers32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\system32\ctfmon.exe"3⤵PID:2252
-
-
-
C:\Program Files\Common Files\System\server32.exe"C:\Program Files\Common Files\System\server32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4260
-
-
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\system32\ctfmon.exe"2⤵PID:4488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5e1ca5ed8fef91bc4f7fcadb33b0db1d4
SHA1b7270b17986bed82066e8781628d78ed7715c20c
SHA25697b121ada0e870a58919aaf3fcde9884f95b18d28acdff44f7fa864930a789ed
SHA512fd01b9c7a62f9440417d8e792e2a99c4fd384383ba264c40f6f28c413bab81cbedeaad82d91e5f14690225e2de9324dc7530b8992a4111c4ded3a69c3811a2f8