40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a

General

Target
40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Size 448KB
Sample260504-w1mtyset3l
SHA256 40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a
MD5 4ad1c1a1d8ce7d49e2d2fadb599c462f
SHA1 0458ccd2c3a29caf0bc737aa57683b63c454b293
SHA512 c99fb2a39835427406670b553673622769cfd9b430291c652660a75239d970d75ee5847468bd7892d12dc090851c42993a1d34c6e3f812bc5f5c3504dc0bcf13
SSDEEP 6144:acTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:aSvO2x9mONvKRILSF/Okx2LIatyD
TLSH
T1DCA45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2332	c9835495

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Destination IP	2	223.5.5.5	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Destination IP	7	114.114.114.114	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Destination IP	8	223.5.5.5	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	c9835495
File created	C:\Windows\SysWOW64\c9835495	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	c9835495
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	c9835495

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\27ecb8	c9835495
File opened for modification	C:\Windows\148b60	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9835495

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	c9835495
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	c9835495
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	c9835495
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	c9835495
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	c9835495
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	c9835495
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	c9835495
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	c9835495
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	c9835495

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2332	c9835495
2332	c9835495
2332	c9835495
2332	c9835495
2332	c9835495
2332	c9835495
2332	c9835495
2332	c9835495
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Token: SeTcbPrivilege	1200	40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
Token: SeDebugPrivilege	2332	c9835495
Token: SeTcbPrivilege	2332	c9835495

C:\Users\Admin\AppData\Local\Temp\40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe
"C:\Users\Admin\AppData\Local\Temp\40125d931faa6eb34355154e18a94ab95ed6d73f0fabd907d0e70e25891d7f5a.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\Syswow64\c9835495
C:\Windows\Syswow64\c9835495
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c9835495

Path C:\Windows\SysWOW64\c9835495
Size 448KB
SHA256 2471e2b8dd166613fd03471972e623c95406e84dd300ab91e5cc47a9e1382e9a
MD5 3f0c707823cbd8baf17e268e3ffbf9f0
SHA1 eade51789d33231797c2d0bbc5ccf9ee3eab9fff
SHA512 2c032278d55c4bd9c96a2c2803f884ea4662bab003b40c0494987ea86c2de5952bdebb745aba2027f37e89c366b8403bf8e0706f24717f1362ddf6c7ce37087b
SSDEEP 6144:EcTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:ESvO2x9mONvKRILSF/Okx2LIatyD
TLSH
T119A45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-0-0x0000000000090000-0x00000000000F3000-memory.dmp

Download

memory/1200-10-0x0000000001020000-0x000000000106A000-memory.dmp

Download

memory/1200-22-0x0000000001020000-0x000000000106A000-memory.dmp

Download

memory/2332-4-0x0000000000E50000-0x0000000000EB3000-memory.dmp

Download

memory/2332-11-0x0000000001830000-0x000000000187A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads