Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-11-2024 13:13
General
-
Target
55c09e2d816cf1cd9dd61aaf5929dde2ad194607013875cec32491865b35216dN.exe
-
Size
93KB
-
MD5
6c4d2452cf967605051579479de8e3a0
-
SHA1
980c0088d1b1ee9cd5e7a0dbc614b09d9d893cfb
-
SHA256
55c09e2d816cf1cd9dd61aaf5929dde2ad194607013875cec32491865b35216d
-
SHA512
f4f96d101e53179b5224bc29149df11446161e4a93d56928c6c23e718dcc4e3099a76633b51eac64a9e48101f978cf843971cb259772106c08af475cfc28558a
-
SSDEEP
1536:AUhSyh6zaoFjuFCVR5jEwzGi1dDVDigS:AUKzaujuCRWi1dRH
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55c09e2d816cf1cd9dd61aaf5929dde2ad194607013875cec32491865b35216dN.exe"C:\Users\Admin\AppData\Local\Temp\55c09e2d816cf1cd9dd61aaf5929dde2ad194607013875cec32491865b35216dN.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\server.exe"C:\Windows\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD57a8184d640ef6cdf954a7f10b80dc908
SHA1541efc229f03c114a3e8f8413a293947e2578e82
SHA256f82cb3b7c58b97a0b99662278b17e1cfb211ac7db5640f116ee2cc78475a1887
SHA512cfa2535b3f842bc525b5d07053fd0267bbdea903364965971b472a172395c557d716b3caa5330a80c197331ce6b0fa6c1d3cb9bed4ae290fc4a8190479425659
-
Filesize
93KB
MD56c4d2452cf967605051579479de8e3a0
SHA1980c0088d1b1ee9cd5e7a0dbc614b09d9d893cfb
SHA25655c09e2d816cf1cd9dd61aaf5929dde2ad194607013875cec32491865b35216d
SHA512f4f96d101e53179b5224bc29149df11446161e4a93d56928c6c23e718dcc4e3099a76633b51eac64a9e48101f978cf843971cb259772106c08af475cfc28558a
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB