fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2

General

Target
fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Size 547KB
Sample260423-mkptyabt4j
SHA256 fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2
MD5 242945e0542a255b8eaed82d2c811cec
SHA1 3bf88ae19eee356d7c9ba3d231cd6d2fdf5c58f9
SHA512 7e8f4c2469796237a0cdef4834a5fdb7659cb3bdaea16d465e9bee3d05ba7c6d5992035633d307daa520ff14c48e9cc58092c38e96dba385cf1c5eeb8c251ec2
SSDEEP 6144:lcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:lSvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T1B5C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4448	2cee9f2e

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Destination IP	10	223.5.5.5	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Destination IP	31	114.114.114.114	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Destination IP	32	223.5.5.5	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	2cee9f2e
File created	C:\Windows\SysWOW64\2cee9f2e	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	2cee9f2e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	2cee9f2e

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4c26c0	2cee9f2e
File opened for modification	C:\Windows\8e710	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cee9f2e
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2cee9f2e
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2cee9f2e
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2cee9f2e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2cee9f2e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2cee9f2e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2cee9f2e
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	2cee9f2e
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2cee9f2e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2cee9f2e

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
4448	2cee9f2e
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Token: SeTcbPrivilege	520	fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
Token: SeDebugPrivilege	4448	2cee9f2e
Token: SeTcbPrivilege	4448	2cee9f2e

C:\Users\Admin\AppData\Local\Temp\fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe
"C:\Users\Admin\AppData\Local\Temp\fcfa4ba64f28f789c537a5e8cdab6200756e7fcde7fe44ef9c0cdc314fac5fb2.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\Syswow64\2cee9f2e
C:\Windows\Syswow64\2cee9f2e
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2cee9f2e

Path C:\Windows\SysWOW64\2cee9f2e
Size 547KB
SHA256 7090bdbe223403cb23ce72c98bf77b6cc3573e39703edb910830bc671efaa460
MD5 2e1c812679a28eee6305195414d0d3ca
SHA1 5639cd9682793a6f2ce9ee7669651a57acc1b295
SHA512 044c490c0b151196573dcc9a1f29c4d123981c7f41d0d88ec58f2fbd22db3b0af455c5831200b0f3c0b9014e530857c141147a9d3ffd4dd651be7164a5b327f2
SSDEEP 6144:mcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:mSvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T19DC47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-0-0x0000000000F80000-0x0000000000FE3000-memory.dmp

Download

memory/520-25-0x00000000039B0000-0x0000000003A46000-memory.dmp

Download

memory/520-26-0x0000000003BC0000-0x0000000003BD9000-memory.dmp

Download

memory/520-36-0x0000000003BC0000-0x0000000003BD9000-memory.dmp

Download

memory/520-54-0x0000000003BC0000-0x0000000003BD9000-memory.dmp

Download

memory/4448-4-0x00000000005B0000-0x0000000000613000-memory.dmp

Download

memory/4448-15-0x0000000002370000-0x0000000002406000-memory.dmp

Download

memory/4448-16-0x0000000002840000-0x0000000002859000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads