f28711542218b72a926ac9490ad33798b52a9f7789c53c995c06d7fd3025a445

General

Target

Eroot 1.2.exe
Size

11.1MB
MD5

1137767398b23ed9eeef2beaba1f575b
SHA1

ed4e83118a0ecd02c58bb4aa1cc8c3783d3ee48d
SHA256

8ca91dfa1c9daa024fd3c1af38fd65fddb0ca067abafefd6f99e3d3f3ec0d417
SHA512

76fb9890db61d3d0d048d16a024b556176ffb1bda452e9f17b0532e17dc5d25bda064d6060b29e40af54fbf0d9e7a78d7c3275bb76317f4c1b421960504e6d74
SSDEEP

196608:H3TqLoZTO593DM8ZnGCRxGCRPBuTZGXutLSI7RPyuaonlhlvbtKtXihAifkXJFnz:Hjc+TKdD1VBXBVBuTplvFpKkAi8XvN0S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2508	bec.exe
1144	bec.exe

Loads dropped DLL 6 IoCs

pid	Process
2244	Eroot 1.2.exe
2244	Eroot 1.2.exe
2508	bec.exe
2508	bec.exe
1144	bec.exe
1144	bec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eroot 1.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	Eroot 1.2.exe
1144	bec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2508	2244	Eroot 1.2.exe	28
PID 2244 wrote to memory of 2508	2244	Eroot 1.2.exe	28
PID 2244 wrote to memory of 2508	2244	Eroot 1.2.exe	28
PID 2244 wrote to memory of 2508	2244	Eroot 1.2.exe	28
PID 2508 wrote to memory of 1144	2508	bec.exe	30
PID 2508 wrote to memory of 1144	2508	bec.exe	30
PID 2508 wrote to memory of 1144	2508	bec.exe	30
PID 2508 wrote to memory of 1144	2508	bec.exe	30

C:\Users\Admin\AppData\Local\Temp\Eroot 1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Eroot 1.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Roaming\ERoot\resource\bin\bec.exe
  start-server
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Roaming\ERoot\resource\bin\bec.exe
    adb fork-server server
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ERoot\resource\bin\bec.exe

Filesize
1.2MB

MD5
996228fd22c2b03190a4e4c38a1efb5e

SHA1
ab8fab4fb5c0980c76490856ad044a5b7bff81a1

SHA256
575b1a26244c0762af689b5b55f3812f1293806364092962368cd5b581627c8f

SHA512
e57f94dbaa443aca0feddc7b7db565ef23b3d9180cf00d893c7d8b4390446f6fc087de03b2ca7178077d7d90182a5e07ef5ab923d07fd5b4a0086e3c821f2585

Download Submit
\Users\Admin\AppData\Roaming\ERoot\resource\bin\AdbWinApi.dll

Filesize
94KB

MD5
47a6ee3f186b2c2f5057028906bac0c6

SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8

SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b

SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584

Download Submit
\Users\Admin\AppData\Roaming\ERoot\resource\bin\AdbWinUsbApi.dll

Filesize
59KB

MD5
5f23f2f936bdfac90bb0a4970ad365cf

SHA1
12e14244b1a5d04a261759547c3d930547f52fa3

SHA256
041c6859bb4fc78d3a903dd901298cd1ecfb75b6be0646b74954cd722280a407

SHA512
49a7769d5e6cb2fda9249039d90465f7a4e612805bba48b7036456a3bbd230e4d13da72e4ade5155ddc08fe460735ec8d6df3bb11b72ff28e1149221e2fc3048

Download Submit
memory/1144-151-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-153-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-146-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-149-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-150-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-160-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-152-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-145-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-154-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-155-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-156-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-157-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-158-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1144-159-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/2508-144-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing