5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd

General

Target
5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Size 547KB
Sample260421-a341csat8t
SHA256 5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd
MD5 986e6ed912582b1ce8ddd4b58fdaa4a6
SHA1 a895c3f3981759c9f27af2b1fde69e2b4e220166
SHA512 38f1a907b91abcc339e04a674347afbc9c904756d947c3297a8f6fcf47a73eb37d0ab85806f9351c494676ed0c3f7a17fafc6f0d67b71ade89e63a6b02c87543
SSDEEP 6144:dcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:dSvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T135C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1664	5558d8c6

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	2	114.114.114.114	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Destination IP	4	223.5.5.5	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Destination IP	31	114.114.114.114	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Destination IP	32	223.5.5.5	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	5558d8c6
File created	C:\Windows\SysWOW64\5558d8c6	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	5558d8c6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	5558d8c6

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1c7d00	5558d8c6
File opened for modification	C:\Windows\299178	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5558d8c6

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	5558d8c6
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	5558d8c6
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	5558d8c6
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	5558d8c6
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	5558d8c6
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	5558d8c6
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	5558d8c6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	5558d8c6
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	5558d8c6

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
1664	5558d8c6
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Token: SeTcbPrivilege	2428	5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
Token: SeDebugPrivilege	1664	5558d8c6
Token: SeTcbPrivilege	1664	5558d8c6

C:\Users\Admin\AppData\Local\Temp\5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe
"C:\Users\Admin\AppData\Local\Temp\5a64893d353bf756c4d18ce825945321a342feefcc6414070175926953159ddd.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\Syswow64\5558d8c6
C:\Windows\Syswow64\5558d8c6
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5558d8c6

Path C:\Windows\SysWOW64\5558d8c6
Size 547KB
SHA256 f1fa2857ad707c8f86e16585d3f5a022d37832f5fb40e9b217f80afd58a90dfa
MD5 cebc454c9c102923c798bc8df310fef6
SHA1 a37f79f723fc2eb3210a42497f90db1172707852
SHA512 ec89f948ed2f23e1e580e7cf81760a4e351f724cccc6467f515fab3fe0f6c706ecf51c5991bab57bd2e6b66978d5a06b9a9a117ca3c7504f621463cd0d214e68
SSDEEP 6144:KcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:KSvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T1B7C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-4-0x00000000002B0000-0x0000000000313000-memory.dmp

Download

memory/1664-19-0x0000000000890000-0x0000000000897000-memory.dmp

Download

memory/1664-20-0x0000000001400000-0x0000000001681000-memory.dmp

Download

memory/2428-0-0x0000000000350000-0x00000000003B3000-memory.dmp

Download

memory/2428-18-0x0000000001790000-0x0000000001797000-memory.dmp

Download

memory/2428-32-0x0000000003300000-0x0000000003581000-memory.dmp

Download

memory/2428-60-0x0000000003300000-0x0000000003581000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads