bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a

General

Target
bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Size 3.0MB
Sample260426-k7amesct7w
SHA256 bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a
MD5 b0b330ab330bd2b0cd34e59d461b72d6
SHA1 4a4c6cddfc1c4ad4aa7bf81ea76645c24f8ee4c6
SHA512 4a11284ec1c967b07014aa1bde7667328b9b6bb3e6ef847d3ae0690d5af8152f20bfb21b3f97c528be4ebf319fa07bb29a45d0b4fee69e1d1a407b4383fbef26
SSDEEP 49152:cHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMj:cnKdBWsM0r1Qn1K4XKH40Feu
TLSH
T157E58E11F7A0C036C4AB027589BA476EA678FD614B2547CBA3C47B2E5F723D16E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2488	18d40ef7

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	5	114.114.114.114	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Destination IP	6	223.5.5.5	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Destination IP	23	114.114.114.114	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Destination IP	24	223.5.5.5	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\18d40ef7	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	18d40ef7
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	18d40ef7
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	18d40ef7
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	18d40ef7

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2a9870	18d40ef7
File opened for modification	C:\Windows\4a2a58	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d40ef7

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	18d40ef7
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	18d40ef7
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	18d40ef7
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	18d40ef7
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	18d40ef7
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	18d40ef7
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	18d40ef7
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	18d40ef7

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
2488	18d40ef7
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Token: SeTcbPrivilege	4332	bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
Token: SeDebugPrivilege	2488	18d40ef7
Token: SeTcbPrivilege	2488	18d40ef7

C:\Users\Admin\AppData\Local\Temp\bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe
"C:\Users\Admin\AppData\Local\Temp\bfc429f71e72975c7912778440e32edd740cf3a58e4941be519aee246b343b5a.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Windows\Syswow64\18d40ef7
C:\Windows\Syswow64\18d40ef7
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18d40ef7

Path C:\Windows\SysWOW64\18d40ef7
Size 3.0MB
SHA256 dcd598cdf4db47485d7a9feaff81bf3175caa2e2212576457d4a1b7945bcd04f
MD5 7fec8a39672bb4a528eb01582c1be040
SHA1 91d7e3c89dc2639e3851378fb148e9c064f85ac6
SHA512 df7d509bb32fa3cd70ff4f166b9c63067ea07bfe4d6f1124c5da6c65e3bc7dde06f62dbc4a6e2cc355408f321e5908c4bfb132abdaf3dc9b1fb9fa6645976b6b
SSDEEP 49152:jHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMj:jnKdBWsM0r1Qn1K4XKH40Feu
TLSH
T1B3E58E11F7A0C036C4AB027589BA476EA678FD614B2547CBA3C47B2E5F723D16E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2488-4-0x0000000000B50000-0x0000000000BB3000-memory.dmp

Download

memory/4332-0-0x0000000000310000-0x0000000000373000-memory.dmp