916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5

General

Target

916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Size

2.5MB
MD5

52f0beb4bc05d14654c718f035926e62
SHA1

36db183bf9e2667d5b71bb9ff381e654d357e01d
SHA256

916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5
SHA512

56bfd419b6692242b452e257ed0ea0b956a8639bc7ad56169ecb822bb6b1412fe7f22ed786042f7e09ae024eb071214722f2f1a0e7199a5414ea87960a151fe5
SSDEEP

49152:LWBj/cZ6dm/O6ytbioxX6ZPSVbINZ9JyKEOL6+mD8OUgt1w:9p//yxxXK6Gn9J9hL6VQNgt1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2600	sg.tmp

Loads dropped DLL 1 IoCs

pid	Process
2600	sg.tmp

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1128-0-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1932-7-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1932-10-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-25-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-26-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-27-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-28-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-30-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-31-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-32-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-33-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-34-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-35-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-36-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-37-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-38-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-39-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral2/memory/1128-40-0x0000000000400000-0x00000000005FB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sg.tmp

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeBackupPrivilege	1932	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	1932	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	1932	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	1932	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	2600	sg.tmp
Token: 35	2600	sg.tmp
Token: SeSecurityPrivilege	2600	sg.tmp
Token: SeSecurityPrivilege	2600	sg.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	sg.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1088	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	86
PID 1128 wrote to memory of 1088	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	86
PID 1128 wrote to memory of 1932	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	90
PID 1128 wrote to memory of 1932	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	90
PID 1128 wrote to memory of 1932	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	90
PID 1128 wrote to memory of 2600	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	92
PID 1128 wrote to memory of 2600	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	92
PID 1128 wrote to memory of 2600	1128	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	92

C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
"C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1553408 -len=1086808 "C:\Users\Admin\AppData\Local\Temp\~8617198114058697755.tmp",,C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\~4155601093496879383~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~8617198114058697755.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~1303738569263368580"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~4155601093496879383~\7z.dll

Filesize
1.1MB

MD5
4a224bc36119d0a9b3f862edefc9a91a

SHA1
fcd584077825f86a27e7a8575c4cd971ddecd387

SHA256
b339f59e151cdc460d944b59ad92b4f33e6be148b72c23e116fcc47ebabb1575

SHA512
1e27c150976bbcc05f3d118f9bcdd0a5f61e1fdcc5a57387261c87fa2d2c2bf817cd93510c6eff504e10cc099389e8acbe9ceb543c9515edce3249409af22a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~4155601093496879383~\sg.tmp

Filesize
415KB

MD5
5e397bb9f0fe8b98104f1c124435c936

SHA1
08fca294ed1c828ca796930d0457f2d7d2896a31

SHA256
338600eeede3179be5666dd49e4998cf7993db9bc16c5b8ac9cfaffaae260579

SHA512
7ba684daab5cba6993c0b20883db19b0468a56dcc7fde406fbe47256e7e90668911742ad43077e3cbedb190931018b65428d45ebef81cbba092789553fbeb06c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~8617198114058697755.tmp

Filesize
1.0MB

MD5
de0fbe94c4b601b03782d5f7bfb6bf0b

SHA1
66a012bdcf47c9245807126fcb74cce66354d37b

SHA256
0631923c95b63e0ff0df0fce1be0f67e291e36f57565965527f46201c406e34e

SHA512
050bc9ca755356b9b19cfdb0fb09b31b2385c7967a39e653d617de8645d20751494120251708f0a696ca720a771b5737ca286bd62db3ca5b337a688bbc17f7b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~2558622484359233091.tmp

Filesize
119B

MD5
2a20acdd863f44a7c1128cbe7115a959

SHA1
c4c8720c0c9b86c3631e01c4c382e70ffd9cbcbc

SHA256
9567df59b06e43c5f945d3ebec637d941f22e5de04973ddf22b65b14cb7620c9

SHA512
767ce18e211b4ef3db3980db6d0df5a8d1638a1adcd57b7e67270ea62dd7b90718b1e817bb19f1c6569f250861a61c36734b6ce1cfa9ae6fe1983a60e9bb8d04

Download Submit
memory/1128-28-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-30-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-40-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-24-0x0000000000C40000-0x0000000000C50000-memory.dmp

Filesize
64KB

Download
memory/1128-25-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-26-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-27-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-29-0x0000000000C40000-0x0000000000C50000-memory.dmp

Filesize
64KB

Download
memory/1128-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-39-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-31-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-32-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-33-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-34-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-35-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-36-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-37-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1128-38-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1932-10-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1932-7-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing