8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3

General

Target

8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
Size

78KB
MD5

7bfbe9f42a7aa4e975f7946d44b3260f
SHA1

35b0151f326b99687a8344c5af9e3fb431499ec9
SHA256

8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3
SHA512

7b8d5113fc2642541da57bef8cc7f53eaab22dc0f7c25c93f274ebf9ee17395912e494ebe86b3804547f5677a9bcf2d493a4fdee2f6dbd5501c628d848ea89f1
SSDEEP

1536:9RWtHF3M7t/vZv0kH9gDDtWzYCnJPeoYrGQtRk9/O1GD:9RWtHF8h/l0Y9MDYrm7Rk9/H

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2820	tmpB57A.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\peverify = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft.CSharp.exe\""	tmpB57A.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB57A.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
Token: SeDebugPrivilege	2820	tmpB57A.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2160	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	30
PID 2780 wrote to memory of 2160	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	30
PID 2780 wrote to memory of 2160	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	30
PID 2780 wrote to memory of 2160	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	30
PID 2160 wrote to memory of 2932	2160	vbc.exe	32
PID 2160 wrote to memory of 2932	2160	vbc.exe	32
PID 2160 wrote to memory of 2932	2160	vbc.exe	32
PID 2160 wrote to memory of 2932	2160	vbc.exe	32
PID 2780 wrote to memory of 2820	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	33
PID 2780 wrote to memory of 2820	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	33
PID 2780 wrote to memory of 2820	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	33
PID 2780 wrote to memory of 2820	2780	8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe	33

C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
"C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lsov0-mo.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5E7.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB5E8.tmp

Filesize
1KB

MD5
40f485bd74e4fdfa2b3eb08a334a6988

SHA1
862f215c27a144e0297c1cda88050252dff1c284

SHA256
cc47dddeba31c692b3525ba31be7a2c6e9ea7bc65335df65bbf54d6a989152ea

SHA512
fe62fb2904263e34fac50d849e5119bcfe9c008a1847b430f9786a4f3b096f86e494d4aa62e9a5bcd47f983a5e10b64fe6e7704a8e74ec4344637269a38620ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsov0-mo.0.vb

Filesize
15KB

MD5
194039781f2fa9bba5e5c334f68eab22

SHA1
f058c1bdd8927d293bb3453a133dd830800bf227

SHA256
92f2432d6fadc232b002a3666475dc7c40973a02eeb26f13be3cfc3e2ffa044a

SHA512
c8a7275c0358497eede44cbdf2b2755c6ce2088e7309b1f68445d33fe4390a395f5f50bfcbc93225bf3ebd2b87f692b72205681ecc13453c7e870f7e5d561b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsov0-mo.cmdline

Filesize
266B

MD5
cd1958dfa752c5987f4525c677d51a5a

SHA1
9cb3c9b5a1e507f481e7b26b1b270f5c3ad6bc77

SHA256
7b38772c1e33ae3476240a61a41391ba9ce504329a5b4b5947dead9e00c30a78

SHA512
eda2bf6ca853b29b575067b24d0af33e419552ab3f8f7c5f66133725f25655a291718c2cb17979d5baa3ede5009728e8894dd7a00e09a6b7b324cbf7ccabbb07

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe

Filesize
78KB

MD5
91c4685b31172962bf6b5ee1d99f5794

SHA1
fc85e74f6a0cc172191e397884416f54167082ab

SHA256
b56e89e266a2b5b5ee977d5c2062bb303bd7eec6d6b3371f77c966c504b14d15

SHA512
21ae56d0bd682fe7746be665a2443d16914a81707696f1af662d08decb591f32a8e9035115d4bfad06808b97c9009a503e9ca86d7e1ff7fd3ef2b98af9194519

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB5E7.tmp

Filesize
660B

MD5
6d1275ee7b413b79a922ce629867a519

SHA1
920a66a5632f4d5a5037e458bfcfba052c0860a5

SHA256
c5191eeafdaf787a15fd185567a3f298accb197c5a1d0f51cd6d3bb42d75cb21

SHA512
62df7a513a5a328a18649e4b31e7b58df3cc51265ea4c15a4ccb02fcd854312416daba1099ec7c9b62b105be2452c2623dc5eb546ea19d09db166ec814f446e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8b25b4d931908b4c77ce6c3d5b9a2910

SHA1
88b65fd9733484c8f8147dad9d0896918c7e37c7

SHA256
79c261ab6b394ee23ab0fd0af48bcd96f914c6bb88b36b6815b6bbf787ecd56e

SHA512
6d954066cec5eca118601f2f848f5c9deebe3761ac285c6d45041df22e4bc4e9e2fd98c1aa4fbb6b9c735151bf8d5fffa5acddf7060a4cf3cb7e09271a4a926d

Download Submit
memory/2160-18-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2160-8-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-0-0x0000000074491000-0x0000000074492000-memory.dmp

Filesize
4KB

Download
memory/2780-1-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-24-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-3-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads