176aa707017e73c91de26c96856a10a014f69c881638f4ee2c6cac6b533b2ffa

General

Target

2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
Size

388KB
MD5

a1aa9fc284a78253608b54c1ae6c681f
SHA1

9523103ebd0f1fa5987bb0cfb48c5c89ad4db717
SHA256

176aa707017e73c91de26c96856a10a014f69c881638f4ee2c6cac6b533b2ffa
SHA512

0b46e63c4bdc5a3b552f1de3c90a2e21e8e31bbd6fc98d8c7f3b45cf43d1ce4560b07ff53a68dc3ac6f6af1ad84f6e58943ae55f516a89fb4fe6f4538705422b
SSDEEP

6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvy:/uTs1gBpQL5kmh0671o1CS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2512	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2612	conlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2612	2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	31
PID 2852 wrote to memory of 2612	2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	31
PID 2852 wrote to memory of 2612	2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	31
PID 2852 wrote to memory of 2612	2852	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	31
PID 2612 wrote to memory of 2512	2612	conlhost.exe	32
PID 2612 wrote to memory of 2512	2612	conlhost.exe	32
PID 2612 wrote to memory of 2512	2612	conlhost.exe	32
PID 2612 wrote to memory of 2512	2612	conlhost.exe	32
PID 2612 wrote to memory of 1952	2612	conlhost.exe	35
PID 2612 wrote to memory of 1952	2612	conlhost.exe	35
PID 2612 wrote to memory of 1952	2612	conlhost.exe	35
PID 2612 wrote to memory of 1952	2612	conlhost.exe	35
PID 2612 wrote to memory of 2952	2612	conlhost.exe	38
PID 2612 wrote to memory of 2952	2612	conlhost.exe	38
PID 2612 wrote to memory of 2952	2612	conlhost.exe	38
PID 2612 wrote to memory of 2952	2612	conlhost.exe	38

C:\Users\Admin\AppData\Local\Temp\2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\users\Public\del.bat
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2512
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1952
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\FILES_BACK.txt

Filesize
213B

MD5
e0f532d18ae3962b63c24d0c32a4fb47

SHA1
537ad020916b230d6ae0199b2767eb2fd239ee35

SHA256
f49ef221271dc6a8fef1cf78b5ff1f99a7662d4f53287082e914bcac2bc46904

SHA512
8de985919ff56085f80f5cac3d3878bc9c71226a02037816b66bdc1974176dc315039e0583c839e66785990db34780a59004921debf4effe289d78e199dd5cf9

Download Submit
C:\users\Public\del.bat

Filesize
115B

MD5
d285bb11b0fb4db4627de1708810f62b

SHA1
e2ea7f2a48a9169dbe93e4ee5e238fe6beb3b9fe

SHA256
b1f0346b9eb5b488449d5dec41f5ff004a7a823ac19f97732609ac53be6d82c9

SHA512
6645a58ce061e0f7105c4c540db139f678b41b1397ea42de82f399a87ddd5f4f07423f5b82710fea3850367aa1b0822fd0e0aa6d009b100a4f93187b059d1bbb

Download Submit
\Users\Public\conlhost.exe

Filesize
388KB

MD5
5c6e5c7c8da1b2c5b2dfaa651e5c1392

SHA1
3e4e1b51b8a524e8b279b4060731409d1d34d49d

SHA256
6d8b3ed3c805e9cf74d6080737bfe9c7b9151a64e9c29a5ab1c370c731d7ccb1

SHA512
a72c7c0a921f12f5a2ae1edeade6ee31aad7717668ad9f94e836816f92dac077d193af04e4fc46104c03239ace1c5404a49b32bfde2ee141a507bfdc232dedaa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads