2f05e23edec61e746e86cd46e79d6af02ec93705f755a1f9683e953cd9406890

General

Target

mexican.exe
Size

3.6MB
MD5

b9ce72d9fa47b960c5912662ba09b4c7
SHA1

5147cd82eff424a9ba48f64d873b7200d546bdb8
SHA256

2f05e23edec61e746e86cd46e79d6af02ec93705f755a1f9683e953cd9406890
SHA512

8a59922d3c8acbc2224e66444c1e852392f378f0d288747f848169e07b1f23bf86d6bba10831421f5c3e81d8c74b791bd306cce8f545eca52b0e397694587e7a
SSDEEP

98304:QkqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13U:QkSIlLtzWAXAkuujCPX9YG9he5GnQCAB

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2620	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2228	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	mexican.exe
Token: SeDebugPrivilege	2228	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1544	2792	mexican.exe	31
PID 2792 wrote to memory of 1544	2792	mexican.exe	31
PID 2792 wrote to memory of 1544	2792	mexican.exe	31
PID 1544 wrote to memory of 1424	1544	cmd.exe	33
PID 1544 wrote to memory of 1424	1544	cmd.exe	33
PID 1544 wrote to memory of 1424	1544	cmd.exe	33
PID 1544 wrote to memory of 2228	1544	cmd.exe	34
PID 1544 wrote to memory of 2228	1544	cmd.exe	34
PID 1544 wrote to memory of 2228	1544	cmd.exe	34
PID 1544 wrote to memory of 2620	1544	cmd.exe	35
PID 1544 wrote to memory of 2620	1544	cmd.exe	35
PID 1544 wrote to memory of 2620	1544	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\mexican.exe
"C:\Users\Admin\AppData\Local\Temp\mexican.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e7aa03f2-c1aa-4e8b-8eba-1cd5b92f73c3.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /PID 2792
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\system32\timeout.exe
    timeout /T 2 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab80A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

Filesize
2KB

MD5
26f214101971b95bc873488d55c7da07

SHA1
a69221288f302c3961468873fb3240ee90098826

SHA256
33fdf2041c6aa8cc8e26b3c1e4441e993ad08dbac98f53da057e29a7fc889c40

SHA512
26be25851c8574f4a1d0c467ba72fc6a77b6ebb74f76e7565b44ae50fcfdeeb0440869c533cf7e23bfa630b4ed9e0cfea86a105148b63e73aa1a99e347dec4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

Filesize
2KB

MD5
b2397e7b69705b54621244fb6b65e4e1

SHA1
27e73747d9fffbc656d88d2d02cb306d3c45db32

SHA256
babfa5a05d627ba92570b3f25b5eba01dc12f89679060e80840ad0cac5124a10

SHA512
0a0d7db19731b6bc141779b72d93aa7d2c096084eef0680cb514bd3f50ffd289f6ffbe4ba94a58b18932d0d7cce4d5540c8b203c32b7e83092db05125bccf1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar80AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7aa03f2-c1aa-4e8b-8eba-1cd5b92f73c3.bat

Filesize
152B

MD5
60c22390ffd6c910bd11ecd8d9d7c8ff

SHA1
ff5033061d7b8f5ff6b958955ce2e807014c33f0

SHA256
3b0174aa7c7c875f18302a760ac624a95a1cc550a106f96603ddc64a472d0f39

SHA512
1b07135aab7e821cc72cc6ea8ca1d3861abe312e39e0e13d87e6e80b21a4a58b5a5887ccb78cdedc654f04cd87bc3e64d328588ae5bd6d902daa9db2a19753ca

Download Submit
memory/2792-0-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Filesize
4KB

Download
memory/2792-1-0x0000000000B20000-0x0000000000EBA000-memory.dmp

Filesize
3.6MB

Download
memory/2792-2-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-198-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Filesize
4KB

Download
memory/2792-255-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-307-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing