Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2024 17:21
Behavioral task
behavioral1
Sample
2545b47e98ffb00e68912dbedcb8f5db.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2545b47e98ffb00e68912dbedcb8f5db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2545b47e98ffb00e68912dbedcb8f5db.exe
-
Size
93KB
-
MD5
2545b47e98ffb00e68912dbedcb8f5db
-
SHA1
0612d0f4417ebb63e52ad1da47db3209e848332a
-
SHA256
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
-
SHA512
d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
SSDEEP
1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 4852 netsh.exe 512 netsh.exe 4904 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2545b47e98ffb00e68912dbedcb8f5db.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe -
Executes dropped EXE 3 IoCs
pid Process 2580 server.exe 3648 StUpdate.exe 436 StUpdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 17 5.tcp.eu.ngrok.io 65 5.tcp.eu.ngrok.io 98 5.tcp.eu.ngrok.io -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explore.exe server.exe File opened for modification C:\Windows\SysWOW64\Explore.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explore.exe server.exe File opened for modification C:\Program Files (x86)\Explore.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2545b47e98ffb00e68912dbedcb8f5db.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe 2580 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe Token: 33 2580 server.exe Token: SeIncBasePriorityPrivilege 2580 server.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2580 1228 2545b47e98ffb00e68912dbedcb8f5db.exe 82 PID 1228 wrote to memory of 2580 1228 2545b47e98ffb00e68912dbedcb8f5db.exe 82 PID 1228 wrote to memory of 2580 1228 2545b47e98ffb00e68912dbedcb8f5db.exe 82 PID 2580 wrote to memory of 4852 2580 server.exe 83 PID 2580 wrote to memory of 4852 2580 server.exe 83 PID 2580 wrote to memory of 4852 2580 server.exe 83 PID 2580 wrote to memory of 512 2580 server.exe 85 PID 2580 wrote to memory of 512 2580 server.exe 85 PID 2580 wrote to memory of 512 2580 server.exe 85 PID 2580 wrote to memory of 4904 2580 server.exe 86 PID 2580 wrote to memory of 4904 2580 server.exe 86 PID 2580 wrote to memory of 4904 2580 server.exe 86 PID 2580 wrote to memory of 1540 2580 server.exe 87 PID 2580 wrote to memory of 1540 2580 server.exe 87 PID 2580 wrote to memory of 1540 2580 server.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2545b47e98ffb00e68912dbedcb8f5db.exe"C:\Users\Admin\AppData\Local\Temp\2545b47e98ffb00e68912dbedcb8f5db.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4852
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:512
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1540
-
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3648
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:436
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
Filesize
93KB
MD52545b47e98ffb00e68912dbedcb8f5db
SHA10612d0f4417ebb63e52ad1da47db3209e848332a
SHA25618240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
SHA512d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
Filesize
4B
MD54d853d9c7197ee7fa81c6535b1f7d655
SHA1eac3d866e991967b385f3dd22da25e410d8f7f49
SHA2565abdb6175f820f0ac3d8647fbb1f7a0bcc91757a782a8a145570944ca6a00c96
SHA512dc5a09d8586eb9f591f6e00187817c19f693e9328a1b2e5838c61c0b234e9608eecc45bbf7f4a90912e9a456d0ab469ed2503bafb4988b276cec8d5f0b18fda7