c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9

General

Target
c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe
Size 50KB
Sample241113-c4kdfstraw
SHA256 c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9
MD5 a16d02806623ff581fe503b35fd7db32
SHA1 c9c6895d6497f0b07e23f2103181d912167f81dd
SHA512 ca1d45e8015c03d77b08ff4193b916b1ffb1d2971418186cc42e6ce157eb3def75d219eca04f7206559f112893b7cae5049e6b6bcf6f39c0544d4adc963af0a4
SSDEEP 1536:MLdY8B4HFqn5yZHALya6idstrrrd++CCCC1:seHon5yZHDa6istrrrd++CCCC1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2784	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	rwmhost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2244-5-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2948-11-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2948-12-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2948-14-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2948-16-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2948-17-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\rwmhost.exe	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe
File created	C:\Windows\Debug\rwmhost.exe	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rwmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2244	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2784	2244	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe	31
PID 2244 wrote to memory of 2784	2244	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe	31
PID 2244 wrote to memory of 2784	2244	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe	31
PID 2244 wrote to memory of 2784	2244	c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe	31

C:\Users\Admin\AppData\Local\Temp\c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe
"C:\Users\Admin\AppData\Local\Temp\c5f307b4f92de8f2098c8da83d61a7ec4c42a6a0aa7d22379849b109f8bf2db9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C5F307~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2784

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rwmhost.exe

Path C:\Windows\debug\rwmhost.exe
Size 50KB
SHA256 a3309e8fcb57e973456b4d173fdc2a088f9b510100a3f1697b2b74ce28ab1218
MD5 4b097b4931b4412c01671386bef10f33
SHA1 1353d125b4e9f788b1535b92a095ded3cb94de31
SHA512 74a4e776d46e1551826873e145a7de467be7b095a79678619d0dd1f95205ce8dc56905297a75e6000dac61326643c0c96ddecc23de442a37ed7641f012cd4db9
SSDEEP 1536:MLdY8B4HFqn5yZHALya6idstrrrd++CCCCa:seHon5yZHDa6istrrrd++CCCCa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2244-0-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2244-5-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2948-11-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2948-12-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2948-14-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2948-16-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2948-17-0x0000000010000000-0x000000001000E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads