a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596

General

Target

a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
Size

5.4MB
MD5

16b863fa661a5d24e850a0feda5bd6da
SHA1

e582dadafae242db7dee278cda1800be63e07f9a
SHA256

a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596
SHA512

f22dfddb567ce4dc6686c25a515a7ac0bcf496e353ada2276b59bc87ad296cea7f38dc217251a61a2c2ff11d773f182b990a0ecf260d5b7653f69bb061d9359d
SSDEEP

98304:e9EU/5gIY3JOKJBAUZLeVzArOSqeDalc6d:e9X61xJV8c9BDal

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3520-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3520-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
3520	a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe

C:\Users\Admin\AppData\Local\Temp\a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe
"C:\Users\Admin\AppData\Local\Temp\a99a7fb6da38761d59f53cbcd4ab7f437054e6a14fabbf488e22b548521e9596.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
8.4MB

MD5
8b6c94bbdbfb213e94a5dcb4fac28ce3

SHA1
b56102ca4f03556f387f8b30e2b404efabe0cb65

SHA256
982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53

SHA512
9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a

Download Submit
memory/3520-5-0x0000000000413000-0x0000000000414000-memory.dmp

Filesize
4KB

Download
memory/3520-6-0x0000000000400000-0x000000000099E000-memory.dmp

Filesize
5.6MB

Download
memory/3520-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-46-0x0000000000400000-0x000000000099E000-memory.dmp

Filesize
5.6MB

Download
memory/3520-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-11-0x0000000000400000-0x000000000099E000-memory.dmp

Filesize
5.6MB

Download
memory/3520-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3520-57-0x0000000010028000-0x000000001003D000-memory.dmp

Filesize
84KB

Download
memory/3520-56-0x0000000000400000-0x000000000099E000-memory.dmp

Filesize
5.6MB

Download
memory/3520-55-0x0000000000400000-0x000000000099E000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing