05a5ceb6e0916979c4bebf3be189ec8a63119159b45e86cc5b97d3f1712a5e58

General

Target

supe-07.25.exe
Size

26.3MB
MD5

7df7867a4ecfad069a52b3244237ab77
SHA1

e29a1a6a295a4c2409302f084e96ff28d1a8deb3
SHA256

05a5ceb6e0916979c4bebf3be189ec8a63119159b45e86cc5b97d3f1712a5e58
SHA512

d7ff2f3fc298428c1db37675e6a0f2fafade304ed2a36cfd3be182e8cf9fc63a172dbdaf5f2c8c84e5dbee00982b9bffac603933fd8bf2f544a626fa408b15b3
SSDEEP

393216:Vad0aJOX87sZkeSg4G/nIjIRRZrRHkaBPO95WYP4r:wNyv4G/nIjIRRZrRHkaBGn9K

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000019473-10.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2784	Tomcat.exe

Executes dropped EXE 1 IoCs

pid	Process
2784	Tomcat.exe

Loads dropped DLL 3 IoCs

pid	Process
2672	supe-07.25.exe
2784	Tomcat.exe
2784	Tomcat.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000019473-10.dat	upx
behavioral1/memory/2784-12-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral1/memory/2784-24-0x0000000000290000-0x00000000002A8000-memory.dmp	upx
behavioral1/memory/2784-26-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	supe-07.25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomcat.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2672	supe-07.25.exe
2672	supe-07.25.exe
2672	supe-07.25.exe
2672	supe-07.25.exe
2672	supe-07.25.exe
2672	supe-07.25.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe
2784	Tomcat.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	Tomcat.exe
Token: SeLockMemoryPrivilege	2784	Tomcat.exe
Token: SeCreateGlobalPrivilege	2784	Tomcat.exe
Token: SeBackupPrivilege	2784	Tomcat.exe
Token: SeRestorePrivilege	2784	Tomcat.exe
Token: SeShutdownPrivilege	2784	Tomcat.exe
Token: SeCreateTokenPrivilege	2784	Tomcat.exe
Token: SeTakeOwnershipPrivilege	2784	Tomcat.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2672	supe-07.25.exe
2672	supe-07.25.exe
2784	Tomcat.exe
2784	Tomcat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2784	2672	supe-07.25.exe	31
PID 2672 wrote to memory of 2784	2672	supe-07.25.exe	31
PID 2672 wrote to memory of 2784	2672	supe-07.25.exe	31
PID 2672 wrote to memory of 2784	2672	supe-07.25.exe	31

C:\Users\Admin\AppData\Local\Temp\supe-07.25.exe
"C:\Users\Admin\AppData\Local\Temp\supe-07.25.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\Documents\Tomcat.exe
  "C:\Users\Admin\Documents\Tomcat.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\conf.ini

Filesize
114B

MD5
2ddaf7e1090c3c3e5b338012cf94fc74

SHA1
ac05e1bcba3d70b8d13e15087f3d5013bdcfd0c5

SHA256
361ee489fc056142d0f92a3c42eabd2cae71683eac310d291019379329fa5be4

SHA512
b296d8c73a12261099ac1693ea9141212eab50d7cf6c815c050af56355d523c2c692f7c5a13511e398f6ee208ac392ddba2dd9d6d17430e2b6c720c7c7fb04a8

Download Submit
\Users\Admin\AppData\Roaming\Ling\malloc\L_mimalloc.dll

Filesize
148KB

MD5
051d69a619adca3472e8d7c9b0c0eb5c

SHA1
6cc795ac90e43e408919e19ba6f5633863560459

SHA256
feefc12464985e2057a4cbd54117e9414f2e00a284106fa38b62d63052a1f7dd

SHA512
50daa3344aa4d86cdd22cf5736eec993467e6574c5e341cd0fd95757c739e167b6e76c744b29ae302d08c88d469fea0767640a9257f54f9dec2c5fbb87c23b71

Download Submit
\Users\Admin\AppData\Roaming\zlib.dll

Filesize
27KB

MD5
849e9f3e59daf750db838e885d58c6fa

SHA1
733cb105153e4b83160a52bfa2ddd95d750fb806

SHA256
f94949a6c121a525f661dd8abd917eb37a5cf582c89e3a258170a15d30cc0cc2

SHA512
3feff6db5fc5ae371a4ec60ce13a383668a5accac537a0ae56b9b5b7318a2d5bdb4b79286a519cad3610cb6d1f335a11c09a4d3165c147a00d5a7880ea23e173

Download Submit
\Users\Admin\Documents\Tomcat.exe

Filesize
2.0MB

MD5
b37ae64fe66840408c8efd8eb49064ac

SHA1
cd8afb6c90c7a3505655a953ac3123043b51c6f0

SHA256
cf44020af1a8bc79cd9f5769208213f7c5feb50e96af699672625cbcf6782fe3

SHA512
e5ba7e241e10373df4236547f2566c9d5b26a625b63902ec1b96113287a57bee068792e1d01a7a7190866ac19ed0d9ab979fffb931264950b798fea78a10a252

Download Submit
memory/2672-7-0x0000000006DE0000-0x0000000007020000-memory.dmp

Filesize
2.2MB

Download
memory/2672-33-0x0000000006DE0000-0x0000000007020000-memory.dmp

Filesize
2.2MB

Download
memory/2784-12-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2784-13-0x0000000002B60000-0x0000000002C69000-memory.dmp

Filesize
1.0MB

Download
memory/2784-8-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2784-24-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2784-25-0x0000000000390000-0x00000000003E9000-memory.dmp

Filesize
356KB

Download
memory/2784-26-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2784-34-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing