119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95

General

Target

119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
Size

280KB
MD5

ebda4498a4f12fc4fd8f89a974218b40
SHA1

c968d7ab02de9db080fb302058607283989c14e2
SHA256

119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95
SHA512

38e1ab26aba496739b71be4c3ab40f93a4c33738d2d38eb4f063b24a5003db0756fb01228a719ff0de2bb840cb642e8ef23bd3762ef72444d9fb68ba7400e677
SSDEEP

6144:GXSQ8BCMis1TMrRQwy7eIeCDb1mY8cEOkCybEaQRXr9HNdvOa:GXv8BCLocRZy7eIeybt6Okx2LIa

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	588c8368

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4280-0-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/files/0x000900000002347b-2.dat	upx
behavioral2/memory/3032-3-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/4280-11-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/3032-13-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/4280-12-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/3032-15-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/3032-17-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/4280-24-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/3032-25-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/4280-26-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/3032-29-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/3032-30-0x0000000000C70000-0x0000000000CFE000-memory.dmp	upx
behavioral2/memory/4280-31-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/4280-34-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/4280-35-0x0000000000F90000-0x000000000101E000-memory.dmp	upx
behavioral2/memory/4280-36-0x0000000000F90000-0x000000000101E000-memory.dmp	upx

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_3AF0FDC80EA858911339035786739FF3	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	588c8368
File created	C:\Windows\SysWOW64\588c8368	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_3AF0FDC80EA858911339035786739FF3	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	588c8368
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	588c8368

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	588c8368

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	588c8368
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	588c8368
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	588c8368
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	588c8368
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	588c8368
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	588c8368
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	588c8368
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	588c8368
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	588c8368

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3032	588c8368
3032	588c8368
3032	588c8368
3032	588c8368
3032	588c8368
3032	588c8368
3032	588c8368
3032	588c8368
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
Token: SeTcbPrivilege	4280	119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
Token: SeDebugPrivilege	3032	588c8368
Token: SeTcbPrivilege	3032	588c8368

C:\Users\Admin\AppData\Local\Temp\119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe
"C:\Users\Admin\AppData\Local\Temp\119630f05cb37d5893c204c7ab28234cbb775fff54de8e54beb9c8f7f7a2ec95.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\Syswow64\588c8368
C:\Windows\Syswow64\588c8368
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\588c8368

Filesize
280KB

MD5
ec225a2e1689ec59239f3148deeb0e3c

SHA1
2b6a603faa14af8a98c39fe9f4b9ca70cbb75516

SHA256
7610c366c27e24f3e317319b41bfb8c7a0e7524bc9f109615b2c5d38809086a1

SHA512
49062f8cf559f17fb91e70ee59311514113b8dbae4c3795f3978e1f214227471d1ab387a196556053da129bb6a7d222db34b76eaa4a298a70ac7af53a340d040

Download Submit
memory/3032-30-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-25-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-29-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-13-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-17-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-15-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/3032-3-0x0000000000C70000-0x0000000000CFE000-memory.dmp

Filesize
568KB

Download
memory/4280-12-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-26-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-24-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-11-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-0-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-31-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-34-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-35-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download
memory/4280-36-0x0000000000F90000-0x000000000101E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing