ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a

General

Target
ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Size 761KB
Sample260423-1ybfcsav8x
SHA256 ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a
MD5 545e4d89ced8e5df4697f469754cf18c
SHA1 0da13a4ece5c1009beacaede660f83d87bdbaade
SHA512 cc4387240e1523b2e79a96d97cf6c5a56e22729a4436835b8a8dfe85b531338d8b10ef12dd94b822e723d15f2fea4afdbef87afa94e3eb0a7630452f1118efd0
SSDEEP 12288:USvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:nvO2xJKRw2kOkxSkW298B
TLSH
T183F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2480	c46fab60

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	2	223.5.5.5	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Destination IP	15	114.114.114.114	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Destination IP	16	223.5.5.5	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Destination IP	1	114.114.114.114	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	c46fab60
File created	C:\Windows\SysWOW64\c46fab60	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	c46fab60
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	c46fab60

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x00000000006F0000-0x000000000077C000-memory.dmp	upx
behavioral2/files/0x0008000000000436-2.dat	upx
behavioral2/memory/2480-7-0x0000000000A80000-0x0000000000B0C000-memory.dmp	upx
behavioral2/memory/3152-18-0x00000000006F0000-0x000000000077C000-memory.dmp	upx
behavioral2/memory/2480-20-0x0000000000A80000-0x0000000000B0C000-memory.dmp	upx
behavioral2/memory/2480-36-0x0000000000A80000-0x0000000000B0C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2a7560	c46fab60
File opened for modification	C:\Windows\35f6a0	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c46fab60

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	c46fab60
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	c46fab60
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	c46fab60
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	c46fab60
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	c46fab60
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	c46fab60
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	c46fab60
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	c46fab60
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	c46fab60

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2480	c46fab60
2480	c46fab60
2480	c46fab60
2480	c46fab60
2480	c46fab60
2480	c46fab60
2480	c46fab60
2480	c46fab60
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Token: SeTcbPrivilege	3152	ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
Token: SeDebugPrivilege	2480	c46fab60
Token: SeTcbPrivilege	2480	c46fab60

C:\Users\Admin\AppData\Local\Temp\ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe
"C:\Users\Admin\AppData\Local\Temp\ab97492df2a8cd140b3b56c11dd7c9d42dd6a747041081b9ee47b759475e1d5a.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\Syswow64\c46fab60
C:\Windows\Syswow64\c46fab60
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c46fab60

Path C:\Windows\SysWOW64\c46fab60
Size 761KB
SHA256 2f38e8d6be608e26afbfd951998e1af00f758f4d14a247819eb893e2ecf9b19d
MD5 ca639b9006450419562bf0ab12e2b705
SHA1 3ed14ab4f6ed37e1f17c865aaff261dcc4d1a7a9
SHA512 323948a8566b6d43849a50c93ce60da4016729b540611bd5c70a276c1f7aa3def1fb72c0ee9f01a0d0b81c9121bf88f9aaaea7d1495a13e1123a2bab17830bf3
SSDEEP 12288:0SvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:HvO2xJKRw2kOkxSkW298B
TLSH
T19DF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-7-0x0000000000A80000-0x0000000000B0C000-memory.dmp

Download

memory/2480-19-0x0000000001CD0000-0x0000000001D34000-memory.dmp

Download

memory/2480-20-0x0000000000A80000-0x0000000000B0C000-memory.dmp

Download

memory/2480-36-0x0000000000A80000-0x0000000000B0C000-memory.dmp

Download

memory/3152-0-0x00000000006F0000-0x000000000077C000-memory.dmp

Download

memory/3152-18-0x00000000006F0000-0x000000000077C000-memory.dmp

Download

memory/3152-27-0x00000000033A0000-0x0000000003404000-memory.dmp

Download

memory/3152-44-0x00000000033A0000-0x0000000003404000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads