ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521

General

Target

ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
Size

78KB
MD5

75ff12ea9064e40f908eb242e4d6ebd0
SHA1

b54770ae47a7aa867c14806cf09c0ac7e041f8a8
SHA256

ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521
SHA512

98d2855f5fe33bfc03c5c6d429e535e5f4890f7cc32581ad8315bdb306968342397b70d511e56364bb17878dc38d7ab9edbcd1a674bf0ab49e436f16be5c54e0
SSDEEP

1536:FuHY6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQte6Q9/51gT:FuHYnhASyRxvhTzXPvCbW2Ue6Q9/G

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	tmp10.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp10.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp10.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
Token: SeDebugPrivilege	1380	tmp10.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2436	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	29
PID 2904 wrote to memory of 2436	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	29
PID 2904 wrote to memory of 2436	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	29
PID 2904 wrote to memory of 2436	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	29
PID 2436 wrote to memory of 2868	2436	vbc.exe	31
PID 2436 wrote to memory of 2868	2436	vbc.exe	31
PID 2436 wrote to memory of 2868	2436	vbc.exe	31
PID 2436 wrote to memory of 2868	2436	vbc.exe	31
PID 2904 wrote to memory of 1380	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	32
PID 2904 wrote to memory of 1380	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	32
PID 2904 wrote to memory of 1380	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	32
PID 2904 wrote to memory of 1380	2904	ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe	32

C:\Users\Admin\AppData\Local\Temp\ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
"C:\Users\Admin\AppData\Local\Temp\ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_brnfqp5.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES281.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc280.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2868
- C:\Users\Admin\AppData\Local\Temp\tmp10.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp10.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ed204e3a6b980aa54434e55f09a9d5a24d4a92c8ea152bc921f29e658707d521N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES281.tmp

Filesize
1KB

MD5
9ad95ba92ac89f76fc6aaf0cb131f9b0

SHA1
a6d660660cc3b3637ba2e4c5b7f35400e82d25c4

SHA256
a626bb3c374f3ab29b15c2b380b68724e799be24af8cf94a4fbc6b81e1a510d7

SHA512
c5bc1fd9ba1020a68a28995cd50e33a24b0289bd5743729da07ee458e4b3947e0d26f4ad91e5cc01a0f669aaafa57feee2999eeb805608e5b1b6d1172a6c54e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_brnfqp5.0.vb

Filesize
15KB

MD5
20ebcc97d2ad6f6fd3480e7b282ce0a7

SHA1
f0582f34df94345122cd3385af9bf6201d8a8106

SHA256
a095e97dffb797622bbae52d42185e38a3647d00fed2998b3bfe26df191f3d64

SHA512
ce66c84eb1272827d7dde5ce56c3279a5c37b2d77557a8e1aeb072bad7b09f94bb32079b042c322871fbfc89c466ab2c4ccd3c36cc80faa7986d9af3e438a3c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_brnfqp5.cmdline

Filesize
264B

MD5
49e29c3038224ee31c8eab9fcb6716b4

SHA1
1f1cf87e6e364cff230e5268fd60860b08fd020b

SHA256
a98cbd8acddd7ad98003c5dbfc1f50fd8262522bcb4436a591d0b77f541c657d

SHA512
5cb391c9ae276dc305892ce9f4f653ae5439115dbe36a8de3297000809e8f8ed720a854cd0f04eff07c1fd0f2485dab379924f701c186e53eea02dfd347d292c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp10.tmp.exe

Filesize
78KB

MD5
a07108549ea707ce031facb68f61e0b7

SHA1
b9b97eea14b49fa37a6e641c0dab38dca2b416eb

SHA256
32d290647870eee87ec565d2c34331fa74b62abece02ecc52126cd570fd9859c

SHA512
e0981d0d7fc39ec33e64deffc6a9d79e779d1eb4e61498472a2ff0d28e41e90a19a88b48a46516d6af37254c8ca42131189c75407ba3daa1017204f4b620a6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc280.tmp

Filesize
652B

MD5
be0dc92011110cf86faf1fab22733e5b

SHA1
314aa7cf97993d6c1433db07e8ad475ab3a011be

SHA256
bfe6600c8b13ef35a53707975c9e843f5c42fe2405b74d83c2a301b8ecc34280

SHA512
b15ef0a20214a18ad996494ffaacb00eede06d070923821aeb3852f451bbbcb16b36db14adab9ad21971427ef53ec6f9ade874d67576c17c262d45c225ade2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/2436-8-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/2436-18-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-0-0x0000000074441000-0x0000000074442000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-2-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-24-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads