731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca

General

Target

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
Size

3.5MB
MD5

776741bc808602c987aba9cc5efd69cd
SHA1

50f8b6523c0722e36cfb48565fea8206bfdae18c
SHA256

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca
SHA512

a2eb805f4a53d2c47371a60369c4d8892b45221c845ce7214675d09610b45964a72fe1e268228807a9011ffd28e11fda8a5ca32d1cd412942931a703a38dcb2c
SSDEEP

49152:iaNR9UiP8mqlTlIt5olidaPIHMbq0GsoPeBMjTl+qK33x/:i49UrtnIE5wsbbomCPhKR

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exeServer.exeServer.exe

pid process

2368 svchost.exe
4996 Server.exe
3052 Server.exe

pid	process
2368	svchost.exe
4996	Server.exe
3052	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

29 0.tcp.eu.ngrok.io
55 0.tcp.eu.ngrok.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3308 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exesvchost.exe

pid process

4988 731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
2368 svchost.exe

flow	ioc
29	0.tcp.eu.ngrok.io
55	0.tcp.eu.ngrok.io

pid	process
3308	schtasks.exe

pid	process
4988	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
2368	svchost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe
Token: 33	2368	svchost.exe
Token: SeIncBasePriorityPrivilege	2368	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exesvchost.exe

description	pid	process	target process
PID 4988 wrote to memory of 2368	4988	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 4988 wrote to memory of 2368	4988	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 4988 wrote to memory of 2368	4988	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 2368 wrote to memory of 3308	2368	svchost.exe	schtasks.exe
PID 2368 wrote to memory of 3308	2368	svchost.exe	schtasks.exe
PID 2368 wrote to memory of 3308	2368	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
"C:\Users\Admin\AppData\Local\Temp\731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:3308

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:3052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log
Filesize
408B

MD5
42157868488d3ef98c00e3fa12f064be

SHA1
aad391be9ac3f6ce1ced49583690486a5f4186fb

SHA256
b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c

SHA512
8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
3.5MB

MD5
776741bc808602c987aba9cc5efd69cd

SHA1
50f8b6523c0722e36cfb48565fea8206bfdae18c

SHA256
731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca

SHA512
a2eb805f4a53d2c47371a60369c4d8892b45221c845ce7214675d09610b45964a72fe1e268228807a9011ffd28e11fda8a5ca32d1cd412942931a703a38dcb2c

Download Submit
memory/2368-12-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/2368-14-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/2368-17-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4988-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

Filesize
4KB

Download
memory/4988-1-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4988-2-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4988-13-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4996-20-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4996-21-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/4996-23-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads