8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a

General

Target

8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe
Size

26KB
MD5

a283f42e0fe4f929caebd1c4d64dc349
SHA1

b0bbfff84f36e5b79b3f258b2f026461835db2da
SHA256

8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a
SHA512

89a568473321a9d835a8994c34dc40c2022546debef76bbc7d73468f5d8fb951d78c29b37cc024657bf87400ef7fcb17c2987531bba33b7159b0907781fe21bc
SSDEEP

384:yRCDsIr77opNsWCwSC31Uq+KR8wvVKqzFyCUT9kh1RKXVG3/mPpe1aAGPC9shkr:yO37U4WSo1I08w9J50kBKXgPmReM2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	A~NSISu_.tmp

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1452-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/files/0x000b0000000234e9-3.dat	upx
behavioral2/memory/1452-6-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2532-7-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2532-10-0x0000000000400000-0x0000000000428000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A~NSISu_.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1300	taskkill.exe
4704	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770}	A~NSISu_.tmp

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2532	1452	8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe	82
PID 1452 wrote to memory of 2532	1452	8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe	82
PID 1452 wrote to memory of 2532	1452	8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe	82
PID 2532 wrote to memory of 1948	2532	A~NSISu_.tmp	85
PID 2532 wrote to memory of 1948	2532	A~NSISu_.tmp	85
PID 2532 wrote to memory of 1948	2532	A~NSISu_.tmp	85
PID 1948 wrote to memory of 2140	1948	net.exe	87
PID 1948 wrote to memory of 2140	1948	net.exe	87
PID 1948 wrote to memory of 2140	1948	net.exe	87
PID 2532 wrote to memory of 2384	2532	A~NSISu_.tmp	88
PID 2532 wrote to memory of 2384	2532	A~NSISu_.tmp	88
PID 2532 wrote to memory of 2384	2532	A~NSISu_.tmp	88
PID 2384 wrote to memory of 3620	2384	net.exe	90
PID 2384 wrote to memory of 3620	2384	net.exe	90
PID 2384 wrote to memory of 3620	2384	net.exe	90
PID 2532 wrote to memory of 1300	2532	A~NSISu_.tmp	91
PID 2532 wrote to memory of 1300	2532	A~NSISu_.tmp	91
PID 2532 wrote to memory of 1300	2532	A~NSISu_.tmp	91
PID 2532 wrote to memory of 4704	2532	A~NSISu_.tmp	95
PID 2532 wrote to memory of 4704	2532	A~NSISu_.tmp	95
PID 2532 wrote to memory of 4704	2532	A~NSISu_.tmp	95
PID 2532 wrote to memory of 1892	2532	A~NSISu_.tmp	99
PID 2532 wrote to memory of 1892	2532	A~NSISu_.tmp	99
PID 2532 wrote to memory of 1892	2532	A~NSISu_.tmp	99

C:\Users\Admin\AppData\Local\Temp\8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe
"C:\Users\Admin\AppData\Local\Temp\8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.tmp
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.tmp" _=C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\net.exe
    net.exe stop arXfrSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop arXfrSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2140
- - C:\Windows\SysWOW64\net.exe
    net.exe stop ehrecvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ehrecvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /IM Microsoft.HomeServer.Archive.TransferService.exe /T /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /IM ehrecvr.exe /T /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\SysWOW64\CMD.EXE
    CMD.EXE /C "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.bat

Filesize
199B

MD5
0e483e690a4012fb516ed3e05c2c3b92

SHA1
8e72a698714ea620b671dda40998bd4ab2e97569

SHA256
fad227f2876e291e64fdf87bf807649018e86811da20c67076edf5f139c2d24e

SHA512
1cb547b94a342209088745dfd3ebc804d29cfdabed473e5c47e45e69f4e6a44009b3fbf1e8e767f3eab0932afee7ba0b11899f7f7f8a251a4f49ecbfac026029

Download Submit
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.tmp

Filesize
26KB

MD5
a283f42e0fe4f929caebd1c4d64dc349

SHA1
b0bbfff84f36e5b79b3f258b2f026461835db2da

SHA256
8be1ce1049c381cc391d2c01c3f57a1573d3ea2f2a157460569e3f795e56dd1a

SHA512
89a568473321a9d835a8994c34dc40c2022546debef76bbc7d73468f5d8fb951d78c29b37cc024657bf87400ef7fcb17c2987531bba33b7159b0907781fe21bc

Download Submit
memory/1452-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1452-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2532-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2532-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing