8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c

General

Target

8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe
Size

161KB
MD5

e607244e81604ecbc16378b210ed1c1a
SHA1

ce33b33c4b921fa8e256e4c4464f073d52ea7ed1
SHA256

8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c
SHA512

e10fbdb1ccd55a700af7a4f3dd8a32be8f3c6433a224082b8ee8b9bee3872273a940b6395b124406cefe551f53f907139431edf4236aa6d162ffb08eb52d4284
SSDEEP

3072:nmmHmkxbuFD82kzVRqg23RPHksXtLd0Nsr85iXfyBCEnHNe4rPdB+XGSlZ51Jd4n:nTPxbuFDZkhREMshdrH+HnHNe4E0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2612	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	whoami.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1744	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	84
PID 4932 wrote to memory of 1744	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	84
PID 4932 wrote to memory of 1744	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	84
PID 1744 wrote to memory of 5088	1744	cmd.exe	85
PID 1744 wrote to memory of 5088	1744	cmd.exe	85
PID 1744 wrote to memory of 5088	1744	cmd.exe	85
PID 4932 wrote to memory of 2608	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	89
PID 4932 wrote to memory of 2608	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	89
PID 4932 wrote to memory of 2608	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	89
PID 2608 wrote to memory of 892	2608	cmd.exe	90
PID 2608 wrote to memory of 892	2608	cmd.exe	90
PID 2608 wrote to memory of 892	2608	cmd.exe	90
PID 4932 wrote to memory of 1576	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	91
PID 4932 wrote to memory of 1576	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	91
PID 4932 wrote to memory of 1576	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	91
PID 1576 wrote to memory of 2612	1576	cmd.exe	92
PID 1576 wrote to memory of 2612	1576	cmd.exe	92
PID 1576 wrote to memory of 2612	1576	cmd.exe	92
PID 4932 wrote to memory of 4680	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	93
PID 4932 wrote to memory of 4680	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	93
PID 4932 wrote to memory of 4680	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	93
PID 4932 wrote to memory of 3612	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	94
PID 4932 wrote to memory of 3612	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	94
PID 4932 wrote to memory of 3612	4932	8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe	94

C:\Users\Admin\AppData\Local\Temp\8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe
"C:\Users\Admin\AppData\Local\Temp\8f60c1c35b47d33b8f5687ec4626dfa8c57f763cf60330156f16fc939bf1555c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c curl ifconfig.io
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\curl.exe
    curl ifconfig.io
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %USERPROFILE%\Desktop
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c dir C:\Users\Admin\\Desktop
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3612