fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17

General

Target

fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
Size

15.1MB
MD5

0154ec0366d40a5e7e63bd0ecd0c30e2
SHA1

618c8ed461d519d63da1e36dc087653754384acb
SHA256

fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17
SHA512

c4375a8712b85f3f52ddb5d7955e97948552dd1117f372a66704dd5eae89957cd4f7363f47d9d33d9996f4f3c3b68c2c47f676e852a30f0d75b2687889f4f51a
SSDEEP

393216:5vNE5rsfmsABGYgCWGrNfYpimTdSkAVHge5iNhZym36tQM:RK5rs+s+gCJYpFd2ge5iNhBLM

Score

8^/10

discovery evasion persistence privilege_escalation vmprotect

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
672	netsh.exe

Loads dropped DLL 1 IoCs

pid	Process
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1068-9-0x0000000000400000-0x00000000024FD000-memory.dmp	vmprotect
behavioral2/memory/1068-11-0x0000000000400000-0x00000000024FD000-memory.dmp	vmprotect
behavioral2/memory/1068-20-0x0000000000400000-0x00000000024FD000-memory.dmp	vmprotect
behavioral2/memory/1068-21-0x0000000000400000-0x00000000024FD000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	1068	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 232	1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe	86
PID 1068 wrote to memory of 232	1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe	86
PID 1068 wrote to memory of 232	1068	fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe	86
PID 232 wrote to memory of 672	232	cmd.exe	88
PID 232 wrote to memory of 672	232	cmd.exe	88
PID 232 wrote to memory of 672	232	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe
"C:\Users\Admin\AppData\Local\Temp\fac325a36b8101e393be47f2ccd976faec2355792e3b7e8ac032de1400abfd17.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1944
  2⤵
  - Program crash
  PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1068 -ip 1068
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\»ð¼ýÂÌÉ«Çø\libcurl.dll

Filesize
611KB

MD5
83e4b75d7022f34c1c8f4a18aea49ee3

SHA1
4a10d56ee8fb703662ea176c317770af82b77fb6

SHA256
530999dfddcb85bf89117c9989354e5fd1efe714b378d7ab05a618a59f1029bf

SHA512
c0728ae5d78e9423b86e1d81554514f7a5514ce82dbd6dd707278f0ebb5ecade5d5e88020495626a4c2cc76b30e5c942d0281a2ff0ce591d16ce80671829553b

Download Submit
memory/1068-4-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/1068-8-0x0000000000B9B000-0x00000000015ED000-memory.dmp

Filesize
10.3MB

Download
memory/1068-2-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/1068-6-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/1068-1-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/1068-3-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1068-9-0x0000000000400000-0x00000000024FD000-memory.dmp

Filesize
33.0MB

Download
memory/1068-11-0x0000000000400000-0x00000000024FD000-memory.dmp

Filesize
33.0MB

Download
memory/1068-0-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1068-19-0x0000000000B9B000-0x00000000015ED000-memory.dmp

Filesize
10.3MB

Download
memory/1068-20-0x0000000000400000-0x00000000024FD000-memory.dmp

Filesize
33.0MB

Download
memory/1068-21-0x0000000000400000-0x00000000024FD000-memory.dmp

Filesize
33.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads