6014b30bcb29b6bcc758164ee4057e84dc08180c12688e2396dd638f2142c322

General

Target

a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe
Size

366KB
MD5

edcb9e4837cb1118d11931bc0955c5eb
SHA1

cb5505dea7d55cf00a7bf3db3d21becf4872da76
SHA256

a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582
SHA512

fc3fff3da308f4cb0359e96a0969393eda0d71ffe03c47ca5caabbe6a91616e4e3b17cd3409262b59503012d37e16f1dd151fd8115dd9ba413f99af7f1845fb0
SSDEEP

6144:Q8JsLcpjzTDDmHayakLkrb4NSarQW5IG5X9hkY3yj:9zxzTDWikLSb4NS7MIG5X9tyj

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1452	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	bot.EXE

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9798681d79b5124405db7dedbc86384.exe	cnsrrs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9798681d79b5124405db7dedbc86384.exe	cnsrrs.exe

Executes dropped EXE 2 IoCs

pid	Process
840	bot.EXE
4448	cnsrrs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d9798681d79b5124405db7dedbc86384 = "\"C:\\Users\\Admin\\AppData\\Roaming\\cnsrrs.exe\" .."	cnsrrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d9798681d79b5124405db7dedbc86384 = "\"C:\\Users\\Admin\\AppData\\Roaming\\cnsrrs.exe\" .."	cnsrrs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnsrrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe
4448	cnsrrs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	cnsrrs.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 840	4460	a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe	83
PID 4460 wrote to memory of 840	4460	a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe	83
PID 4460 wrote to memory of 840	4460	a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe	83
PID 840 wrote to memory of 4448	840	bot.EXE	85
PID 840 wrote to memory of 4448	840	bot.EXE	85
PID 840 wrote to memory of 4448	840	bot.EXE	85
PID 4448 wrote to memory of 1452	4448	cnsrrs.exe	86
PID 4448 wrote to memory of 1452	4448	cnsrrs.exe	86
PID 4448 wrote to memory of 1452	4448	cnsrrs.exe	86

C:\Users\Admin\AppData\Local\Temp\a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe
"C:\Users\Admin\AppData\Local\Temp\a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Roaming\bot.EXE
  "C:\Users\Admin\AppData\Roaming\bot.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Users\Admin\AppData\Roaming\cnsrrs.exe
    "C:\Users\Admin\AppData\Roaming\cnsrrs.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\cnsrrs.exe" "cnsrrs.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\bot.exe

Filesize
28KB

MD5
0ed6051f85c6a8ca4a8f159a57556b25

SHA1
7fb5999f6f56ebc93f1c45778a41bbb8832220ad

SHA256
8c610d2e1965f9f0f030d3d99b18e4289e486d4784136d25db171d42477880ae

SHA512
edee703eff0256255c8be3e45a2ed64a451114549aa4a9fcf2525d4b6406cf716447bc237f7a0e8c51fde09cc179d11108761b4e47ebbeb017d01232f77fd4c2

Download Submit
memory/840-9-0x00000000753E2000-0x00000000753E3000-memory.dmp

Filesize
4KB

Download
memory/840-10-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download
memory/840-11-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download
memory/840-21-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download
memory/4448-22-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download
memory/4448-23-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download
memory/4448-25-0x00000000753E0000-0x0000000075991000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads