8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf

General

Target
8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Size 2.4MB
Sample260421-lyklpscv5m
SHA256 8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf
MD5 4b6ac738416db0acb4c9b211c498094c
SHA1 648790917e611984fd6f50df94bb4b6f0a2fe9bb
SHA512 93e62d564d859a3f1c49d076e8e78b8fd75493562857907de05a37462173876c6e0dc87102b29a6ca0dbe050c6914c9fff9e4ce6ca15d0021c006a5c7e44d244
SSDEEP 49152:ZHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:ZnKdVkOhCXHHFZMjHfUKkVWsi
TLSH
T1EDB58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	2ba79463

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Destination IP	11	223.5.5.5	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Destination IP	24	114.114.114.114	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Destination IP	25	223.5.5.5	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2ba79463	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	2ba79463
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	2ba79463
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	2ba79463
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	2ba79463

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\273d68	2ba79463
File opened for modification	C:\Windows\3b9430	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ba79463

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	2ba79463
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2ba79463
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2ba79463
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2ba79463
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2ba79463
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2ba79463
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2ba79463
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2ba79463
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2ba79463

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2292	2ba79463
2292	2ba79463
2292	2ba79463
2292	2ba79463
2292	2ba79463
2292	2ba79463
2292	2ba79463
2292	2ba79463
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Token: SeTcbPrivilege	3480	8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
Token: SeDebugPrivilege	2292	2ba79463
Token: SeTcbPrivilege	2292	2ba79463

C:\Users\Admin\AppData\Local\Temp\8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe
"C:\Users\Admin\AppData\Local\Temp\8b709d68d187d489af3262bda46351ba4022c77b3f8f51a68fb240e954b6cadf.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\Syswow64\2ba79463
C:\Windows\Syswow64\2ba79463
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ba79463

Path C:\Windows\SysWOW64\2ba79463
Size 2.4MB
SHA256 fb098fc1b07a84b2d67cd8d2be858d5704c054830a4a69ed865bb8737d2cbc90
MD5 4cf2f55fdd189b3feaa6779497409c70
SHA1 a76c1c6811bb211cdf4133968b70205ee08c8d97
SHA512 501d6ca521a5649cf14dd6a82ee651f79f36ae69298247d2641ac19028b9bdb3906d99d7518dba426a3f1b89ae370c543e0880d89533b7121ff0c90ff1e5c85f
SSDEEP 49152:MHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:MnKdVkOhCXHHFZMjHfUKkVWsi
TLSH
T114B58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-4-0x0000000000910000-0x0000000000973000-memory.dmp

Download

memory/2292-10-0x00000000018E0000-0x0000000001967000-memory.dmp

Download

memory/3480-0-0x0000000000AD0000-0x0000000000B33000-memory.dmp

Download

memory/3480-17-0x0000000003250000-0x00000000032D7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads