2e3726cfe4faa95d2a007d102286ab4ec3da9368e13aa5cf66e2af314183ce24

General

Target
1CDBEF961CB6AEB497083A2F80BB2E67.exe
Size 450KB
Sample250929-sgathayvbv
SHA256 2e3726cfe4faa95d2a007d102286ab4ec3da9368e13aa5cf66e2af314183ce24
MD5 1cdbef961cb6aeb497083a2f80bb2e67
SHA1 6259a95d12f081eebfb07c82b412279ea7676360
SHA512 e5c7e2879a133a3075be41a3d2be204793a901bf598dcd7e1d015d3abc32debae704602669d195e3ba968c2c92b18ac6204981ccfff9831fc681c6afda5389f6
SSDEEP 12288:HzuZeejM75VgngkHK+1+yGmwO4gZCswESt8s:HzLbloK+IQwO4gRwrt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4220	Item.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 2040	4220	Item.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Item.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1CDBEF961CB6AEB497083A2F80BB2E67.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4220	Item.exe
4220	Item.exe
4220	Item.exe
4220	Item.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	1CDBEF961CB6AEB497083A2F80BB2E67.exe
Token: SeDebugPrivilege	4220	Item.exe
Token: SeDebugPrivilege	2040	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2560	1404	1CDBEF961CB6AEB497083A2F80BB2E67.exe	80
PID 1404 wrote to memory of 2560	1404	1CDBEF961CB6AEB497083A2F80BB2E67.exe	80
PID 1404 wrote to memory of 2560	1404	1CDBEF961CB6AEB497083A2F80BB2E67.exe	80
PID 4220 wrote to memory of 2760	4220	Item.exe	83
PID 4220 wrote to memory of 2760	4220	Item.exe	83
PID 4220 wrote to memory of 2760	4220	Item.exe	83
PID 4220 wrote to memory of 3576	4220	Item.exe	84
PID 4220 wrote to memory of 3576	4220	Item.exe	84
PID 4220 wrote to memory of 3576	4220	Item.exe	84
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85
PID 4220 wrote to memory of 2040	4220	Item.exe	85

C:\Users\Admin\AppData\Local\Temp\1CDBEF961CB6AEB497083A2F80BB2E67.exe
"C:\Users\Admin\AppData\Local\Temp\1CDBEF961CB6AEB497083A2F80BB2E67.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Item" /XML "C:\Users\Admin\AppData\Local\Temp\9eeab25ebd004884847f28ccce799259.xml" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2560

C:\Users\Admin\AppData\Local\ValueCount\hdjjjjit\Item.exe
C:\Users\Admin\AppData\Local\ValueCount\hdjjjjit\Item.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:3576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9eeab25ebd004884847f28ccce799259.xml

Path C:\Users\Admin\AppData\Local\Temp\9eeab25ebd004884847f28ccce799259.xml
Size 1KB
SHA256 40fb8f7dc9f3af5b844ecc6dc4864f8fc30bfb1ad28d477f2cc980f3500db235
MD5 e5a66de65a5cdaeed877d04a5db8fb87
SHA1 f844212be276d86876511d8f6b1d4089767a7d17
SHA512 aa3dd85cc4fcb2d199e8590df88241d9f19c067b76d914bfd71934a9ef0d625e8766a8d36b1b5de3ccc3f2fba8fbcf9a63aa1291b98795dd114aefb9582e7c99
MD5 SHA1 SHA512

Submit Download

Item.exe

Path C:\Users\Admin\AppData\Local\ValueCount\hdjjjjit\Item.exe
Size 450KB
SHA256 2e3726cfe4faa95d2a007d102286ab4ec3da9368e13aa5cf66e2af314183ce24
MD5 1cdbef961cb6aeb497083a2f80bb2e67
SHA1 6259a95d12f081eebfb07c82b412279ea7676360
SHA512 e5c7e2879a133a3075be41a3d2be204793a901bf598dcd7e1d015d3abc32debae704602669d195e3ba968c2c92b18ac6204981ccfff9831fc681c6afda5389f6
SSDEEP 12288:HzuZeejM75VgngkHK+1+yGmwO4gZCswESt8s:HzLbloK+IQwO4gRwrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1404-0-0x0000000000270000-0x00000000002E6000-memory.dmp

Download

memory/1404-1-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/1404-2-0x0000000004DA0000-0x0000000004E98000-memory.dmp

Download

memory/1404-3-0x0000000004FB0000-0x0000000005016000-memory.dmp

Download

memory/4220-10-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads