Analysis Overview
SHA256
9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082
Threat Level: Shows suspicious behavior
The file 9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N was found to be: Shows suspicious behavior.
Malicious Activity Summary
Deletes itself
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Indicator Removal: File Deletion
UPX packed file
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-31 02:57
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-31 02:57
Reported
2024-10-31 03:00
Platform
win7-20240708-en
Max time kernel
119s
Max time network
121s
Command Line
Signatures
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\AhnLab\AhnSvc.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run" | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
Indicator Removal: File Deletion
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\ProgramData\AhnLab\AhnSvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe
"C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe"
C:\ProgramData\AhnLab\AhnSvc.exe
"C:\ProgramData\AhnLab\AhnSvc.exe" /run
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe" >> NUL
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
Files
memory/2204-0-0x0000000000D80000-0x0000000000DA7000-memory.dmp
\ProgramData\AhnLab\AhnSvc.exe
| MD5 | 565b0411afe4ce0349d9d6d00032a44d |
| SHA1 | da221c3c8867885a25dec26139cd1de82da2b3d7 |
| SHA256 | 332357e293648ebaae17ee576cabb1811453b936d4c3b2d9c568ecb697abd710 |
| SHA512 | 2c32987edde00c78174373c772c3ca78c622667d68d6fc1bdbf79242f420d79d0dfa62360afd95eae1e39a1e09f08df4f50a650f462454c56c445e1958855715 |
memory/2204-4-0x00000000000E0000-0x0000000000107000-memory.dmp
memory/316-10-0x00000000012B0000-0x00000000012D7000-memory.dmp
memory/2204-14-0x0000000000D80000-0x0000000000DA7000-memory.dmp
memory/316-16-0x00000000012B0000-0x00000000012D7000-memory.dmp
memory/316-18-0x00000000012B0000-0x00000000012D7000-memory.dmp
memory/2204-22-0x0000000000D80000-0x0000000000DA7000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-31 02:57
Reported
2024-10-31 03:00
Platform
win10v2004-20241007-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\AhnLab\AhnSvc.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AhnUpadate = "\"C:\\ProgramData\\AhnLab\\AhnSvc.exe\" /run" | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
Indicator Removal: File Deletion
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\ProgramData\AhnLab\AhnSvc.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\ProgramData\AhnLab\AhnSvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe
"C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe"
C:\ProgramData\AhnLab\AhnSvc.exe
"C:\ProgramData\AhnLab\AhnSvc.exe" /run
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\9a64aeea1f2fc2a1811b3598b4e2c166d69bd044663d81b70be196b37c5b0082N.exe" >> NUL
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | 69.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
| US | 8.8.8.8:53 | www.kimc10scom | udp |
| US | 8.8.8.8:53 | www.icoway.net | udp |
Files
memory/5008-0-0x0000000000260000-0x0000000000287000-memory.dmp
C:\ProgramData\AhnLab\AhnSvc.exe
| MD5 | 8e2905b8823c58c7764c432e0f2c0a38 |
| SHA1 | 70c64ac0458d3138a0d439ab800febd52397f96b |
| SHA256 | 4509fe0dc17855f5fcb0492b4c25060a3506e6912b3a44a79559d88ccfcc4ee2 |
| SHA512 | d047d17ad41cc687c4f658431632e37b522f44285ad2c6be848dee6b3cec257e69bb667f092b51e46e6c06889803ca4c6291462f96ed4e0743f03e47fc3beafb |
memory/2536-4-0x0000000000840000-0x0000000000867000-memory.dmp
memory/5008-9-0x0000000000260000-0x0000000000287000-memory.dmp
memory/2536-10-0x0000000000840000-0x0000000000867000-memory.dmp
memory/2536-11-0x0000000000840000-0x0000000000867000-memory.dmp