6496030122999703843c59323cd5166f3152a27eeb4ae871e04cd1e780885f38

General

Target

be7266ae3ab6cf0575fa09981a5e75e0N.exe
Size

59KB
MD5

be7266ae3ab6cf0575fa09981a5e75e0
SHA1

432fc76a8c8420ccba93d28162bcb40c654c7cac
SHA256

6496030122999703843c59323cd5166f3152a27eeb4ae871e04cd1e780885f38
SHA512

24cf110357801db1d8af68e7dc5472f6b6f1d90528252ead87fb6844e883cb7ad23d91d2ff76c20b621e24f9a427790b7f5200181cf05d0abe51a9410a4f763a
SSDEEP

1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQ1:OeodiUO4p13b9HiIeoutuh1aQ1

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2624	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	AhnSvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe
2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x00000000008D0000-0x00000000008F7000-memory.dmp	upx
behavioral1/files/0x0008000000015cf7-2.dat	upx
behavioral1/memory/2192-10-0x0000000000D90000-0x0000000000DB7000-memory.dmp	upx
behavioral1/memory/2220-11-0x00000000008D0000-0x00000000008F7000-memory.dmp	upx
behavioral1/memory/2192-12-0x0000000000D90000-0x0000000000DB7000-memory.dmp	upx
behavioral1/memory/2220-18-0x00000000008D0000-0x00000000008F7000-memory.dmp	upx
behavioral1/memory/2192-19-0x0000000000D90000-0x0000000000DB7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	be7266ae3ab6cf0575fa09981a5e75e0N.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be7266ae3ab6cf0575fa09981a5e75e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe
Token: SeDebugPrivilege	2192	AhnSvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2192	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	30
PID 2220 wrote to memory of 2192	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	30
PID 2220 wrote to memory of 2192	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	30
PID 2220 wrote to memory of 2192	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	30
PID 2220 wrote to memory of 2624	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	32
PID 2220 wrote to memory of 2624	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	32
PID 2220 wrote to memory of 2624	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	32
PID 2220 wrote to memory of 2624	2220	be7266ae3ab6cf0575fa09981a5e75e0N.exe	32

C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe
"C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe" >> NUL
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\AhnLab\AhnSvc.exe

Filesize
59KB

MD5
e60f49a4641d49b00ee385644ad16bec

SHA1
50cdc812c9fda1f43a9d0a5a67929965fd230248

SHA256
faf1882974b001f5e264d118b780ae97841cdcdc89ee1d9371f6cb14b8937d7a

SHA512
b322f05900722350512011951bdb951233db9ec29cf8741de32886b0b2390c92bdf38f209a07c501a38d5caea52e8159e0d57a4b0bfb06ade582a545c58cdb93

Download Submit
memory/2192-10-0x0000000000D90000-0x0000000000DB7000-memory.dmp

Filesize
156KB

Download
memory/2192-12-0x0000000000D90000-0x0000000000DB7000-memory.dmp

Filesize
156KB

Download
memory/2192-19-0x0000000000D90000-0x0000000000DB7000-memory.dmp

Filesize
156KB

Download
memory/2220-0-0x00000000008D0000-0x00000000008F7000-memory.dmp

Filesize
156KB

Download
memory/2220-8-0x0000000000070000-0x0000000000097000-memory.dmp

Filesize
156KB

Download
memory/2220-11-0x00000000008D0000-0x00000000008F7000-memory.dmp

Filesize
156KB

Download
memory/2220-18-0x00000000008D0000-0x00000000008F7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads