9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0

General

Target
9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Size 4.0MB
Sample260426-pgdcvah161
SHA256 9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0
MD5 0f9f4d888c93849dcb7b6355b9e4596f
SHA1 7a8df2d46053755ff4207560fdc7a16b8812b84a
SHA512 cd218ef28ec8dcd94405af9d8317aba370ab52fe841a2a656b3811bd80d6d29df33fb6648b43f7276de0ffe530bd1e9f223a46194a94b4b7257e6278ff9e7243
SSDEEP 98304:LnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:LCNDtojKL2Kqo7
TLSH
T14016CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4868	8fe1cdc4

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	45	114.114.114.114	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	46	223.5.5.5	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	81	114.114.114.114	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	82	223.5.5.5	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	150	114.114.114.114	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	151	223.5.5.5	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	3	114.114.114.114	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Destination IP	13	223.5.5.5	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	8fe1cdc4
File created	C:\Windows\SysWOW64\8fe1cdc4	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	8fe1cdc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	8fe1cdc4

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\535788	8fe1cdc4
File opened for modification	C:\Windows\54d938	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fe1cdc4

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	8fe1cdc4
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	8fe1cdc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	8fe1cdc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	8fe1cdc4
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	8fe1cdc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	8fe1cdc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	8fe1cdc4
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	8fe1cdc4
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	8fe1cdc4

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4868	8fe1cdc4
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Token: SeTcbPrivilege	4956	9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
Token: SeDebugPrivilege	4868	8fe1cdc4
Token: SeTcbPrivilege	4868	8fe1cdc4

C:\Users\Admin\AppData\Local\Temp\9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe
"C:\Users\Admin\AppData\Local\Temp\9563c438bb6557a722c63d6e9d24d0fea7da2d93a6973901dadaf7d3d26db6d0.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\Syswow64\8fe1cdc4
C:\Windows\Syswow64\8fe1cdc4
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8fe1cdc4

Path C:\Windows\SysWOW64\8fe1cdc4
Size 4.0MB
SHA256 37264cdc487b36bcc5b634be0e203e957b8e1650bed4a08fbd589bafa6748278
MD5 6c35c1786c32a28643a9f0a02dc204db
SHA1 5392377216e2bb0899f9fc43dd2f7922d985db92
SHA512 1773fa9ce94807ef6d2b5a103c68482eb3d7687dbaf570bba3d30d1632f26198277efe45ec1ed5038684271b5b304071542cfe816e734edb47f174ccc8c3f585
SSDEEP 98304:xnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:xCNDtojKL2Kqo7
TLSH
T19916CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4868-4-0x00000000000F0000-0x0000000000153000-memory.dmp

Download

memory/4868-18-0x0000000001EF0000-0x0000000001FEA000-memory.dmp

Download

memory/4868-32-0x0000000001EF0000-0x0000000001FEA000-memory.dmp

Download

memory/4868-37-0x0000000001EF0000-0x0000000001FEA000-memory.dmp

Download

memory/4956-0-0x0000000000BF0000-0x0000000000C53000-memory.dmp

Download

memory/4956-31-0x0000000003ED0000-0x0000000003FCA000-memory.dmp

Download

memory/4956-33-0x0000000003ED0000-0x0000000003FCA000-memory.dmp

Download

memory/4956-35-0x0000000003ED0000-0x0000000003FCA000-memory.dmp

Download

memory/4956-40-0x0000000003ED0000-0x0000000003FCA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads