2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28

General

Target

2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Size

8.0MB
MD5

7212eb45b28ac2a4b5e2a47d2f092688
SHA1

552014abd99dabc1a31cff10f589811ea3ec95ef
SHA256

2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28
SHA512

08deb9b01909107ad7bd9a634207b8e3f5cd2d1713511f6d3cb4fcdf9dc6e66630ea686684c137a75caea57ccc4a013c7dfa9f4d196a2590013a85c0b0a16b4a
SSDEEP

196608:++HJ8d49OQoOGylEobGCbxdp2G0eGTa8vEWW6oVhL2X69DPt:++HUOGYbGCz0eGOQEV1S6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2188	sg.tmp
2640	抽卡吗？兄弟V8.3.exe

Loads dropped DLL 2 IoCs

pid	Process
2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeBackupPrivilege	1796	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	1796	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	1796	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	1796	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	2188	sg.tmp
Token: 35	2188	sg.tmp
Token: SeSecurityPrivilege	2188	sg.tmp
Token: SeSecurityPrivilege	2188	sg.tmp
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeDebugPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeBackupPrivilege	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeRestorePrivilege	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: 33	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
Token: SeIncBasePriorityPrivilege	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 316	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	28
PID 2428 wrote to memory of 316	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	28
PID 2428 wrote to memory of 316	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	28
PID 2428 wrote to memory of 316	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	28
PID 2428 wrote to memory of 1796	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	30
PID 2428 wrote to memory of 1796	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	30
PID 2428 wrote to memory of 1796	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	30
PID 2428 wrote to memory of 1796	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	30
PID 2428 wrote to memory of 2188	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	31
PID 2428 wrote to memory of 2188	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	31
PID 2428 wrote to memory of 2188	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	31
PID 2428 wrote to memory of 2188	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	31
PID 2428 wrote to memory of 2640	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	33
PID 2428 wrote to memory of 2640	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	33
PID 2428 wrote to memory of 2640	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	33
PID 2428 wrote to memory of 2640	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	33
PID 2428 wrote to memory of 2628	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	34
PID 2428 wrote to memory of 2628	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	34
PID 2428 wrote to memory of 2628	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	34
PID 2428 wrote to memory of 2628	2428	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	34
PID 2628 wrote to memory of 2516	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	35
PID 2628 wrote to memory of 2516	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	35
PID 2628 wrote to memory of 2516	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	35
PID 2628 wrote to memory of 2516	2628	2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe	35

C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
"C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1365504 -len=7012028 "C:\Users\Admin\AppData\Local\Temp\~3848361979446897256.tmp",,C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\~857637989385191304~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~3848361979446897256.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~6199922119170267052.."
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\~6199922119170267052..\抽卡吗？兄弟V8.3.exe
  "C:\Users\Admin\AppData\Local\Temp\~6199922119170267052..\抽卡吗？兄弟V8.3.exe"
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\2cc10cffefea4c973b1c98d671501ede90c454565c0eca2071b34c4f7e6dbc28.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~4721361981755188172.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~4721361981755188172.cmd"
    3⤵
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~3848361979446897256.tmp

Filesize
6.7MB

MD5
d47fdac1d234cb7d4a280e72ad6f70af

SHA1
b342c494715b4bcce0ec2af64b52090f6f4eb9e8

SHA256
66b72a2710e9d65c10d6917eea6a025ce3f0799037db3019e8472449a487e79b

SHA512
d3967590750ac81612783204da2d3c0d372a7236e0333243b12bee27c9c1d4b0e9e1b2c46dfaa2518f3fd98690184aaa2c0df03fc63fc4d5f5d19f10cc0145bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4721361981755188172.cmd

Filesize
379B

MD5
71b6ae68223b444ceec51d496fab999a

SHA1
f8c4c11494aadff50f23d7c78c76420ccc57c7dd

SHA256
c7678960793aa57f8e85908d9c4239e1a53771c749d1195397dc9bb86438cf18

SHA512
1328e97a6978ea26061360378bd80742b15385b43f320a6d4ec2268029527a78f73ad9ef15af55263f6236b52a9ca39de57a7c532beb19c7c2f63c34caf93370

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6199922119170267052..\CET_Archive.dat

Filesize
6.3MB

MD5
03c60c52b8c8a92054dbb2e951a3224d

SHA1
25eeae4ca3c11d6e777eb44da1fd07f1033df589

SHA256
da682b60f58579862a8103a79dbf62615d6253af7090aae04779281fbe60277a

SHA512
539e0fc42a3498e15ec958ab6a95315236d4f69b4601809204af20f2ce91144e5b9c9ab0c1d7184b959caa8870ea53dccc8a72a421f955a652b14d79a9340cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6199922119170267052..\抽卡吗？兄弟V8.3.exe

Filesize
478KB

MD5
122ab9d72198e982d73fe03ceec58ed5

SHA1
9d11e2c60f20be12c7a07a52ed45450a36d1eb05

SHA256
3483dd5330aa14a711b09a0bc7767ee3b127e6c4e2d981e938e76a31f09f8719

SHA512
904299cc4ab3736d36e09d694ae4e7b1185aacd119a478e91e407957c1ecb07a8d1191978edddc258f9de6857f6f0528d7840f502aae7f5a94072362593de2a3

Download Submit
\Users\Admin\AppData\Local\Temp\~857637989385191304~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/2428-26-0x0000000003150000-0x000000000320D000-memory.dmp

Filesize
756KB

Download
memory/2640-29-0x0000000000130000-0x00000000001A0000-memory.dmp

Filesize
448KB

Download
memory/2640-30-0x0000000000130000-0x00000000001A0000-memory.dmp

Filesize
448KB

Download
memory/2640-33-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/2640-32-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2640-31-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2640-35-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2640-34-0x0000000000130000-0x00000000001A0000-memory.dmp

Filesize
448KB

Download
memory/2640-28-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing