c269fad1beef8e4a551060dfc5c5f3133947b65685478f64d27b140edfc77d59

General

Target

Release 2.1/Server.exe
Size

1.8MB
MD5

8eabcefd2de8de4165d584a9e5e97442
SHA1

938a8218cba785ac55e521218d0a09dfe8a4d0e9
SHA256

fd2511e8d9494103d9b11298bee748449392fc742e2952152142840701080427
SHA512

c6607bae21c061ad38292bd7b2810d3cab6d4f1487383b52caf5fcaa5d41e177586ec22cbaff2fef857e44ba827294a5a7e0062556065058b43f966de7dc91e7
SSDEEP

49152:l9ItXMQYmomSkmmtEQQQUmemmmmmmIzmeywwq07uDrWd:l9ItUmomSkmmtEQQQUmemmmmmmIzmeyJ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2616	Server.exe
2616	Server.exe
2616	Server.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	Server.exe

C:\Users\Admin\AppData\Local\Temp\Release 2.1\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Release 2.1\Server.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x86\System.Data.SQLite.DLL

Filesize
1.3MB

MD5
14393eb908e072fa3164597414bb0a75

SHA1
5e04e084ec44a0b29196d0c21213201240f11ba0

SHA256
59b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80

SHA512
f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b

Download Submit
C:\Users\Admin\AppData\Local\Server\Server.exe_Url_kilqcb0nsw1q4lnpfirukwcyer2ctok0\1.0.0.0\jw0nsaiq.newcfg

Filesize
687B

MD5
b18785caae8834f89e34cde89b93cafc

SHA1
cee194149b484295ddba88111a251986bdc0c7af

SHA256
105971bbe15f24f50dad97d466b55222e52dfdb4a71b1b3a6452cfba28a10811

SHA512
fb108e2997a0ea7bce21113118997f358d73a43a40e2b4b9962738cd88dc6d9dfc17e17e63c8ba8c5a5504e5775fbe9e8084ee8e6086cf0eab709335ed8b282c

Download Submit
C:\Users\Admin\AppData\Local\Server\Server.exe_Url_kilqcb0nsw1q4lnpfirukwcyer2ctok0\1.0.0.0\q05orb3u.newcfg

Filesize
561B

MD5
2e8ab7cdc2081c09a98f6c5593909409

SHA1
282769c943f8ab0429315869466d042a99de95f4

SHA256
17eee8708a1bbc35422e6ad9b6eff3bec4f8a8b8a87cce8e6cc0da2d94c9b3ae

SHA512
b815e0deaea5348d5ec68cdba3e4b5018e6224299f170859181f90961831b7d14deda144b32d64b11f8da7f4cbdb0b86a8d253b0ee179df68baac274a363ef2a

Download Submit
C:\Users\Admin\AppData\Local\Server\Server.exe_Url_kilqcb0nsw1q4lnpfirukwcyer2ctok0\1.0.0.0\user.config

Filesize
311B

MD5
a35bc67d130a4fb76c2c2831cbdddd55

SHA1
66502423bba03870522e50608212b6ee27ebf4c5

SHA256
e94a97e512fbc8ed9f5691d921fdeddbff4cc16b024c5335adf66bff3a7a8192

SHA512
4401b234d7914afa860e356be1667cc5f44402255f7cc6cc3d8df80883167f6b55463e62156df57be697ee501897fac61a71f97911c6fdb6630272341ac8a07e

Download Submit
C:\Users\Admin\AppData\Local\Server\Server.exe_Url_kilqcb0nsw1q4lnpfirukwcyer2ctok0\1.0.0.0\user.config

Filesize
434B

MD5
cfcf8e91857f364e002065c52ff8f91c

SHA1
8407ecb3c33a1f3fcf18a723e6884acf7e5a0f4a

SHA256
572dda8c7f211dc6a4efc7aecb4a54cb4e0ced1e4c9a4b9f96bb329c983c64e6

SHA512
364fecac3a051441b4fefcebb2cc9e38632f99dd04593cd5d9b148986afb09b195e88cdbfa2e778b8934564b76d04fe053f919f0a60769b023f2f753ede06d1e

Download Submit
memory/2616-5-0x0000000006B60000-0x0000000006DB2000-memory.dmp

Filesize
2.3MB

Download
memory/2616-30-0x0000000009D20000-0x0000000009D6C000-memory.dmp

Filesize
304KB

Download
memory/2616-7-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-8-0x0000000007570000-0x000000000761A000-memory.dmp

Filesize
680KB

Download
memory/2616-9-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-10-0x0000000009B00000-0x0000000009B2C000-memory.dmp

Filesize
176KB

Download
memory/2616-11-0x0000000009E20000-0x000000000A102000-memory.dmp

Filesize
2.9MB

Download
memory/2616-31-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-13-0x0000000009B80000-0x0000000009BA2000-memory.dmp

Filesize
136KB

Download
memory/2616-1-0x0000000000F30000-0x00000000010FE000-memory.dmp

Filesize
1.8MB

Download
memory/2616-3-0x0000000005AA0000-0x0000000005AFC000-memory.dmp

Filesize
368KB

Download
memory/2616-2-0x0000000006170000-0x0000000006714000-memory.dmp

Filesize
5.6MB

Download
memory/2616-12-0x000000000A3C0000-0x000000000A714000-memory.dmp

Filesize
3.3MB

Download
memory/2616-6-0x0000000005F00000-0x0000000005F0A000-memory.dmp

Filesize
40KB

Download
memory/2616-4-0x0000000005F60000-0x0000000005FF2000-memory.dmp

Filesize
584KB

Download
memory/2616-18-0x0000000009BC0000-0x0000000009D0B000-memory.dmp

Filesize
1.3MB

Download
memory/2616-0-0x000000007525E000-0x000000007525F000-memory.dmp

Filesize
4KB

Download
memory/2616-71-0x000000000B6B0000-0x000000000B6EC000-memory.dmp

Filesize
240KB

Download
memory/2616-72-0x000000000B670000-0x000000000B691000-memory.dmp

Filesize
132KB

Download
memory/2616-82-0x000000000E340000-0x000000000E3F2000-memory.dmp

Filesize
712KB

Download
memory/2616-83-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-84-0x000000007525E000-0x000000007525F000-memory.dmp

Filesize
4KB

Download
memory/2616-85-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-86-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2616-87-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing