ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f

General

Target

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
Size

36KB
MD5

9913a016528f9d9c4aac737c6a06c596
SHA1

197435ebdeab5f6df6e10d1c5aec40812cb9dfdf
SHA256

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f
SHA512

d7013c2edf7245989e1a38e9f4a85aa22e4168c609920d73ecbd9f9006a9060ab78e2ef77a7d22371404b0241a36103b4824287ddb263a495303df12f99c6791
SSDEEP

768:vdfxnLzsA5NVk9FrHE7be6C5jLjkmBcgYcV6kizh:vdfxnLd5yB5jFco6kiz

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2832 powershell.exe
Downloads MZ/PE file

pid	process
2832	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Vx20VTiN5Q.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\Geo\Nation	Vx20VTiN5Q.exe

Executes dropped EXE 1 IoCs

Processes:

Vx20VTiN5Q.exe

pid process

2432 Vx20VTiN5Q.exe
Loads dropped DLL 4 IoCs

Processes:

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exeWerFault.exe

pid process

2256 ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
2692 WerFault.exe
2692 WerFault.exe
2692 WerFault.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 api.ipify.org
8 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2432	Vx20VTiN5Q.exe

pid	process
2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe

flow	ioc
7	api.ipify.org
8	api.ipify.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2832 powershell.exe

pid	process
2832	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exepowershell.exeVx20VTiN5Q.exe

description	pid	process
Token: SeDebugPrivilege	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2432	Vx20VTiN5Q.exe
Token: SeImpersonatePrivilege	2432	Vx20VTiN5Q.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exeVx20VTiN5Q.exe

description	pid	process	target process
PID 2256 wrote to memory of 2832	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	powershell.exe
PID 2256 wrote to memory of 2832	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	powershell.exe
PID 2256 wrote to memory of 2832	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	powershell.exe
PID 2256 wrote to memory of 2832	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	powershell.exe
PID 2256 wrote to memory of 2432	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	Vx20VTiN5Q.exe
PID 2256 wrote to memory of 2432	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	Vx20VTiN5Q.exe
PID 2256 wrote to memory of 2432	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	Vx20VTiN5Q.exe
PID 2256 wrote to memory of 2432	2256	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe	Vx20VTiN5Q.exe
PID 2432 wrote to memory of 2692	2432	Vx20VTiN5Q.exe	WerFault.exe
PID 2432 wrote to memory of 2692	2432	Vx20VTiN5Q.exe	WerFault.exe
PID 2432 wrote to memory of 2692	2432	Vx20VTiN5Q.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
"C:\Users\Admin\AppData\Local\Temp\ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAGEAawBQAE0AaQBNAGIATgBLAFwAVgB4ADIAMABWAFQAaQBOADUAUQAuAGUAeABlACcA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\CakPMiMbNK\Vx20VTiN5Q.exe
  "C:\Users\Admin\AppData\Local\Temp\CakPMiMbNK\Vx20VTiN5Q.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2432 -s 648
    3⤵
    - Loads dropped DLL
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CakPMiMbNK\Vx20VTiN5Q.exe

Filesize
2.5MB

MD5
183e24b654414d7be786ccd8e6a108a5

SHA1
a18e6d0f9d1e67f404985adfa2cc6d756e8680ac

SHA256
69f8cea7a5b6e5de711e9849f4bc0244f1344966364520bc12987f1b90013754

SHA512
8cb2d66a7ffe9e84b9bace8bbd859f050fbf7dc0cb9c4a262bf3467a39d3db43272d40a071fd2867e84a4cd262baa6e5347a46556dcae1a1bffa0497a147850b

Download Submit
memory/2256-14-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-1-0x00000000012D0000-0x00000000012DE000-memory.dmp

Filesize
56KB

Download
memory/2256-2-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-3-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/2256-4-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-5-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/2256-23-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-9-0x000000006FB91000-0x000000006FB92000-memory.dmp

Filesize
4KB

Download
memory/2832-13-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-12-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-15-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-10-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-11-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads