bda3301b2da8c20495ebb0ec7389b696518ffd66468e4f40e69fe04a264846de

General

Target

2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe
Size

388KB
MD5

f5ad23f09d3ba241fe3f07ac704fe6dc
SHA1

ce8aa58274496160aecf0d7038fe03d4246d2be9
SHA256

bda3301b2da8c20495ebb0ec7389b696518ffd66468e4f40e69fe04a264846de
SHA512

ced8e84ab5154b7307ebd27868b3097a382860b0db797873d90d297d529addb8e8f0272c7c609ce3c7aae0a3885186f95f0e4531aea1ea01bd6620398fa02b10
SSDEEP

6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh9k2Hm71orVCvv4:/uTs1gBpQL5kmh9M71oJCY

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2872	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	conlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe
2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2836	2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe	32
PID 2152 wrote to memory of 2836	2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe	32
PID 2152 wrote to memory of 2836	2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe	32
PID 2152 wrote to memory of 2836	2152	2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe	32
PID 2836 wrote to memory of 2872	2836	conlhost.exe	33
PID 2836 wrote to memory of 2872	2836	conlhost.exe	33
PID 2836 wrote to memory of 2872	2836	conlhost.exe	33
PID 2836 wrote to memory of 2872	2836	conlhost.exe	33
PID 2836 wrote to memory of 2860	2836	conlhost.exe	36
PID 2836 wrote to memory of 2860	2836	conlhost.exe	36
PID 2836 wrote to memory of 2860	2836	conlhost.exe	36
PID 2836 wrote to memory of 2860	2836	conlhost.exe	36
PID 2836 wrote to memory of 2820	2836	conlhost.exe	39
PID 2836 wrote to memory of 2820	2836	conlhost.exe	39
PID 2836 wrote to memory of 2820	2836	conlhost.exe	39
PID 2836 wrote to memory of 2820	2836	conlhost.exe	39

C:\Users\Admin\AppData\Local\Temp\2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-02_f5ad23f09d3ba241fe3f07ac704fe6dc_7ev3n.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\users\Public\del.bat
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2860
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\FILES_BACK.txt

Filesize
208B

MD5
56733aa26f3708d48711395de883e19a

SHA1
477126e204df7f9120aca81081e9a8ac30df67d7

SHA256
d2dbc9706a24efd43a0a9b97e84fb77aaa5f8f3b5e1a5951488651b73d5ccd49

SHA512
ab51e5b2017ace80d1bbc7b6cdc7fd20378a0c561b86c15e65ba525ba800d1561911d4d64dd5c79be4de0a2440cbf27633a0381c92a94f3c500d2af24c645d99

Download Submit
C:\users\Public\del.bat

Filesize
115B

MD5
1c8d9b77a24af90ca109261fe0dbff77

SHA1
34b9730336ad27f200ea1ecd83a3b4e0b3fba5d6

SHA256
10bd7d63f540e39789e27bccb43df6cffeedf43e1274fca60d97e9cfef0ca5ec

SHA512
bdcab2dcfe14a942a20b720febf0874f9eadd5e8e50381144053af3a1e3043c81b54bd13d1590d8bd198de7c33cb3b764e7de365188099aa30080a39f832aeab

Download Submit
\Users\Public\conlhost.exe

Filesize
388KB

MD5
7529162c464668f3af40e6f9c4869638

SHA1
ddef7e52b43c858d0be0502145e2fcc392c8572b

SHA256
ca9b3b3a767aea4302aac244ee31d2732c536ff0d45d6aa8ede8004c19e8a14b

SHA512
8fabde32c87d5e5e168d8c2e5d323dd203deddd7a5ae96712ef85b872eeb91b2f28477ce4d7aa66e084b80430bc87a428edc6559200f8e06587a8205b9bf1a33

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads