Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 12:26
General
- Target 3d3de2445037023cf90ce51630f5f919.exe
- Size 3.2MB
- Sample240611-pl6vysxcmp
- SHA256 b243dfd011a918f4604ead2f1c0af4e71daf6302d0c4410231edf68ef0af5d5f
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 5 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3de2445037023cf90ce51630f5f919.exe"C:\Users\Admin\AppData\Local\Temp\3d3de2445037023cf90ce51630f5f919.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mepkulba\mepkulba.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66B9.tmp" "c:\Windows\System32\CSCF9FEE980CFB74C3089A895EB6AE42C50.TMP"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\66hvkSjzJP.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\System.exe"C:\Users\Admin\AppData\Local\System.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nUe3m5ImHN.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\System.exe"C:\Users\Admin\AppData\Local\System.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NfD2T54T3l.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Users\Admin\AppData\Local\System.exe"C:\Users\Admin\AppData\Local\System.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cAX6N4jPhb.bat"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost9⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\System.exe"C:\Users\Admin\AppData\Local\System.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sRyZj7GC23.bat"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵
-
-
C:\Users\Admin\AppData\Local\System.exe"C:\Users\Admin\AppData\Local\System.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
System.exe.log
System.exe
66hvkSjzJP.bat
NfD2T54T3l.bat
RES66B9.tmp
cAX6N4jPhb.bat
nUe3m5ImHN.bat
sRyZj7GC23.bat
mepkulba.0.cs
mepkulba.cmdline
CSCF9FEE980CFB74C3089A895EB6AE42C50.TMP
memory/2800-30-0x000000001B620000-0x000000001B62E000-memory.dmp
memory/2800-42-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-9-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-13-0x000000001B2C0000-0x000000001B2DC000-memory.dmp
memory/2800-14-0x000000001B660000-0x000000001B6B0000-memory.dmp
memory/2800-16-0x0000000001030000-0x0000000001040000-memory.dmp
memory/2800-11-0x0000000001020000-0x000000000102E000-memory.dmp
memory/2800-18-0x000000001B2E0000-0x000000001B2F8000-memory.dmp
memory/2800-22-0x000000001B2A0000-0x000000001B2B0000-memory.dmp
memory/2800-20-0x0000000002980000-0x0000000002990000-memory.dmp
memory/2800-25-0x000000001B2B0000-0x000000001B2BE000-memory.dmp
memory/2800-23-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-27-0x000000001B610000-0x000000001B61E000-memory.dmp
memory/2800-7-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-32-0x000000001B6B0000-0x000000001B6C2000-memory.dmp
memory/2800-38-0x000000001B6F0000-0x000000001B706000-memory.dmp
memory/2800-36-0x000000001B640000-0x000000001B650000-memory.dmp
memory/2800-39-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-41-0x000000001B710000-0x000000001B722000-memory.dmp
memory/2800-8-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-34-0x000000001B630000-0x000000001B63C000-memory.dmp
memory/2800-28-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-46-0x000000001B650000-0x000000001B65E000-memory.dmp
memory/2800-44-0x000000001BC60000-0x000000001C188000-memory.dmp
memory/2800-48-0x000000001B6D0000-0x000000001B6DC000-memory.dmp
memory/2800-50-0x000000001B6E0000-0x000000001B6F0000-memory.dmp
memory/2800-53-0x000000001B730000-0x000000001B740000-memory.dmp
memory/2800-51-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-55-0x000000001B7A0000-0x000000001B7FA000-memory.dmp
memory/2800-43-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-57-0x000000001B740000-0x000000001B750000-memory.dmp
memory/2800-59-0x000000001B750000-0x000000001B75E000-memory.dmp
memory/2800-61-0x000000001B780000-0x000000001B798000-memory.dmp
memory/2800-6-0x000000001B270000-0x000000001B296000-memory.dmp
memory/2800-4-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-3-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-2-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp
memory/2800-0-0x0000000000400000-0x0000000000746000-memory.dmp
memory/2800-1-0x00007FFCCB8F3000-0x00007FFCCB8F5000-memory.dmp
memory/2800-81-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp