10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94

General

Target

10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
Size

3.0MB
MD5

615b11f64d0848a846af31f04c6c9493
SHA1

9ce98696e2e3a1c4920bcff7994ddce5c3e53ea3
SHA256

10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94
SHA512

0afc6002e26be76de521060a1e5a224579efbe1fac00a0ee89958794da8a86f66f2855da7f7d1825bbfdaeed74c15dbba9605c7e76a1a2f621d27d3da9e290f6
SSDEEP

49152:JhCEu1vt7K4wad3mFXlRUhCwwG2IfCdE7cV/tp0V01e9oOYRo61TDERxSAYF7+pB:tuOad341RUhC7gxVOe+3V1vE/SdhJ1+h

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2528-9-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-10-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-12-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-11-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-14-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-16-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-28-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-48-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-20-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-26-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-55-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-54-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-53-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-50-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-46-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-44-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-42-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-40-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-38-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-36-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-34-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-32-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-30-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-24-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-22-0x0000000000320000-0x000000000035F000-memory.dmp	upx
behavioral1/memory/2528-18-0x0000000000320000-0x000000000035F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
2528	10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe

C:\Users\Admin\AppData\Local\Temp\10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe
"C:\Users\Admin\AppData\Local\Temp\10eb45ce2255ee8a6014608332dc715f50bd89cd30e9f3f99163c75ce8deaa94.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E_N30005\krnln.fnr

Filesize
1.2MB

MD5
ce8ca9c229b592c80748d9fb6b2665c3

SHA1
c6b51efc54890ea1c000b62f6802fb1d52cddfe4

SHA256
7407075cd36939f1afdf9e4b15e6b2339367c80ce2affe63028833e47dbc4e13

SHA512
f09268a626ff955e2660047d9cae8ee13917baf0626534e157d334cd37985e1db22c46702e666496c77aa7227432a2182e151a7d342853ef1a375b87806c5f8b

Download Submit
memory/2528-53-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-30-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-10-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-12-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-50-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-14-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-16-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-28-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-48-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-20-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-26-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-55-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-9-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-54-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-11-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-46-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-44-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-42-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-40-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-38-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-36-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-34-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-32-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-0-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2528-24-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-22-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-18-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2528-56-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing