b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4

General

Target

b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
Size

2.5MB
MD5

dea2b172855474242e3607e18f7eb659
SHA1

ce440d756e0bfe5593462d1a4b0c9f818d1f3623
SHA256

b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4
SHA512

42652c9dce689f9e2227651583cedb49dbe67c2c6845703ed35e1e8e502999ff7f1ff959ab7ef6b9ea0a8152a4539ae6b848e8aef4a88e6a9dca0d9c4f3b7e81
SSDEEP

49152:V6i0cnlHeRrlG4g5ec8IBvKvYJC623msvD/DX+y4onCYDj:kPclHeRrlG4g5ea1g62WsvD/D+donCYn

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/604-0-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/files/0x0008000000015fa6-12.dat	upx
behavioral1/memory/604-17-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-20-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-23-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-27-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-30-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-33-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/604-36-0x0000000000400000-0x0000000000555000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1816	604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe	31
PID 604 wrote to memory of 1816	604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe	31
PID 604 wrote to memory of 1816	604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe	31
PID 604 wrote to memory of 1816	604	b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe	31

C:\Users\Admin\AppData\Local\Temp\b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe
"C:\Users\Admin\AppData\Local\Temp\b9ec677efc791e6c4b84b1b5add11bff1a02f7979a644d8b5f066f3758acd2c4.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

Filesize
92B

MD5
16ae5830b2877dac7247f8c4154c9efd

SHA1
fe650b531d9eb8dd0d9d21b8b8c06f1246d397c6

SHA256
a85dd932dfa73597b1281b8ce99b149e1d92577a0daf3e2318b38d1df212e52b

SHA512
84da7c8064c911494893265cc9c4d44fb220711c7bce3f302707a3db3b0c05c2e72580482833221f8f3c5225c6e0ce523a50b883cac6c83b59d80d8388874d85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
47e5904d5c4b3cb88199e095892b3deb

SHA1
ec46f95523479f7515ede378348e67c30aa968a9

SHA256
bdcdbf5040161f6a519482170e43a6e4654d6fec65e3c1191a52ffbc4a5a4c69

SHA512
1dbed7fae69f9f48cf72c1f60abdb254a37b5bc9fcebeb257a393f84e7d45980e43c186bc8223062077f9fa21def74436f70ed9a4ef6fb07e5e158223aa077e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
2.5MB

MD5
18ad053e818ed29c6d43559293045b81

SHA1
67058ccb677ec65e1d1bafc092d54381108fda8a

SHA256
3044b307b72f4ad1b2ad521ea5887b2ef99157b39832f39a5358603f736165f9

SHA512
30ab6a5faf40021e43b96d6f5d70a95d7394002638c300944398a94ff0a4bfb86a00adcd5389f55d93cb3a4e49c00c44642f98750326d165890158b0d558aa53

Download Submit
memory/604-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-17-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-20-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-23-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-27-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-30-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-33-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/604-36-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads