ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282

General

Target

ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe
Size

78KB
MD5

081f7eb3cea9d5246d73df6921c44600
SHA1

71c7e898b40db4f7a0a2c4dd242e6afd8b946a93
SHA256

ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282
SHA512

75087f8ff785895fcdc10cee72241e7efaade4ea926310aa3fb4c87df3a95828b033d7cc9f23d555277071e536a50c3e639f0dd74e54f5a624ae5c63e4b0a815
SSDEEP

1536:95jSBXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN679/I1K4:95jSBSyRxvhTzXPvCbW2UU9/m

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe

Deletes itself 1 IoCs

pid	Process
1460	tmp6A33.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1460	tmp6A33.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp6A33.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6A33.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe
Token: SeDebugPrivilege	1460	tmp6A33.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1364	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	84
PID 2924 wrote to memory of 1364	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	84
PID 2924 wrote to memory of 1364	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	84
PID 1364 wrote to memory of 2040	1364	vbc.exe	87
PID 1364 wrote to memory of 2040	1364	vbc.exe	87
PID 1364 wrote to memory of 2040	1364	vbc.exe	87
PID 2924 wrote to memory of 1460	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	90
PID 2924 wrote to memory of 1460	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	90
PID 2924 wrote to memory of 1460	2924	ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe	90

C:\Users\Admin\AppData\Local\Temp\ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe
"C:\Users\Admin\AppData\Local\Temp\ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bzgda2-o.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B3D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D65545D8E034D5E944974EC2ADC145E.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ef3be8443cf12fc13409d6c4506e665a34f05dab8d1f11fe76fac7880cdd5282N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES6B3D.tmp

Filesize
1KB

MD5
c7bfb439ef43e3696d4c0b2f497d356e

SHA1
d0d2cf67e8aac6acbd144873c0db881aa00f8d4e

SHA256
99e84d3c45582d1ed5999722257d8a1bb4d59ec03751986b367365f71f681300

SHA512
ac013b026372f676cc0272a545cd253ad4112f39903451f5c367b9fc39bac01f9cccaf668717c26c8c0e36a442fba2a61bf16fe5e25774c8d9aa22bdd7a31273

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzgda2-o.0.vb

Filesize
14KB

MD5
08a9624d701d0123404a6e15b3d52bd7

SHA1
749e9b148f57ef8d07a2f8720e0b7b0e6583e63a

SHA256
337ecbd3d8a1d25cf3e492332c2ba50b8bcdf2d7c201b7895dc00dc7a3095a59

SHA512
275246d5438f79ad69e4779c5ff193cc019d416584c3716b44f7ae8151623992765465b8dcece77df5493d191dfbac0e3df9c2a8e20b109d9c0b2cf76b6332eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzgda2-o.cmdline

Filesize
266B

MD5
15171d5f46f441845ef8fa6b29912e54

SHA1
0d7e90564e9c873eb86cb8372bca614346cd191e

SHA256
1d8fea51138d37765a325b4d0f8e2f0b2ace625d4465b526240b7bd505af3d86

SHA512
22c612a0d095c14938224d4dcfba21e609b60fb782a9cd3db709440e43b104e926d703c5f2841dbc977ad22545414db79c0d57b4e392428226c7bc5f37fd4101

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmp.exe

Filesize
78KB

MD5
3cbc0fd4cef5d440a206bca75c400e22

SHA1
b3986fb08a5d554bfd3806863f3469faf6859b8f

SHA256
09b1bc5288d877dbbe516fa6bdf220eb15a72531da1a3159c49833cb4ecb73b6

SHA512
9285f2d27a1afb0e81f7c59a851cf375d929c0fcee585c7ccb8711aeb6c3e9834030ef2f7f31741d48c1db20359f990f6ec0ebf42a576f8cd4482b1691b71fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9D65545D8E034D5E944974EC2ADC145E.TMP

Filesize
660B

MD5
22466384980aa742162f7f15e82d5706

SHA1
f81328dcfa7ebc7efbe98bdd9dfa497ba902313a

SHA256
bfb4de6e6806971d92ddc9dfdc9d75d384fa26c2dc10241150f6a2418e5afa97

SHA512
6f1919597c74ebf46d1b1c49f4748de2b18612081a2d092063dac86d9f5b515d50d9b900684d4b3cd57bb49c934d1e7a818dc11ad428a7706311457f58ecf2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/1364-9-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1364-18-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-23-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-24-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-25-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-27-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-28-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/1460-29-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/2924-0-0x0000000074FE2000-0x0000000074FE3000-memory.dmp

Filesize
4KB

Download
memory/2924-22-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/2924-2-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/2924-1-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads