6496030122999703843c59323cd5166f3152a27eeb4ae871e04cd1e780885f38

General

Target

be7266ae3ab6cf0575fa09981a5e75e0N.exe
Size

59KB
MD5

be7266ae3ab6cf0575fa09981a5e75e0
SHA1

432fc76a8c8420ccba93d28162bcb40c654c7cac
SHA256

6496030122999703843c59323cd5166f3152a27eeb4ae871e04cd1e780885f38
SHA512

24cf110357801db1d8af68e7dc5472f6b6f1d90528252ead87fb6844e883cb7ad23d91d2ff76c20b621e24f9a427790b7f5200181cf05d0abe51a9410a4f763a
SSDEEP

1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQ1:OeodiUO4p13b9HiIeoutuh1aQ1

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	be7266ae3ab6cf0575fa09981a5e75e0N.exe

Executes dropped EXE 1 IoCs

pid	Process
912	AhnSvc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-0-0x0000000000030000-0x0000000000057000-memory.dmp	upx
behavioral2/files/0x00080000000235b6-3.dat	upx
behavioral2/memory/912-5-0x0000000000C90000-0x0000000000CB7000-memory.dmp	upx
behavioral2/memory/4092-8-0x0000000000030000-0x0000000000057000-memory.dmp	upx
behavioral2/memory/912-9-0x0000000000C90000-0x0000000000CB7000-memory.dmp	upx
behavioral2/memory/912-10-0x0000000000C90000-0x0000000000CB7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run"	be7266ae3ab6cf0575fa09981a5e75e0N.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be7266ae3ab6cf0575fa09981a5e75e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AhnSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe
Token: SeDebugPrivilege	912	AhnSvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 912	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	92
PID 4092 wrote to memory of 912	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	92
PID 4092 wrote to memory of 912	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	92
PID 4092 wrote to memory of 1848	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	94
PID 4092 wrote to memory of 1848	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	94
PID 4092 wrote to memory of 1848	4092	be7266ae3ab6cf0575fa09981a5e75e0N.exe	94

C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe
"C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\ProgramData\AhnLab\AhnSvc.exe
  "C:\ProgramData\AhnLab\AhnSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\be7266ae3ab6cf0575fa09981a5e75e0N.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:8
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AhnLab\AhnSvc.exe

Filesize
59KB

MD5
9d905dd1217bf17b607df0d9d2acdbcb

SHA1
890481a36a5fc2abd2a2be879c580723ef4e7971

SHA256
5d727e9bbbedac05b97b352bb3baac347887c1ec4df3d73a3cc1997881694bbc

SHA512
f22fdea2c3189c368c4bb81ec7c359c1beb07de9cff8ec76cd5d4fa99389c6bfaf45d7523604d293065c7b5ad89ca71948d6fa0bc1fe5cb2ae533ce046f2557b

Download Submit
memory/912-5-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download
memory/912-9-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download
memory/912-10-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download
memory/4092-0-0x0000000000030000-0x0000000000057000-memory.dmp

Filesize
156KB

Download
memory/4092-8-0x0000000000030000-0x0000000000057000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads