52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1

General

Target
52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Size 761KB
Sample260508-2dl7ssay2m
SHA256 52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1
MD5 5c4954f1468286ec0a83506e438b4354
SHA1 814e367a74777a3ad425f0492898754f67e9dd45
SHA512 8d8d594590a0f597e3cdc05c28a5d5dc169aa0dea8de40e3fe6ba8f0d14f5b03b6b0ac4d70df00b76b764ce8da1ab64fde80ecaa5e9433bab141ec8549db7df6
SSDEEP 12288:ISvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:DvO2xJKRw2kOkxSkW298B
TLSH
T1ADF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	d9309050

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Destination IP	4	223.5.5.5	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Destination IP	17	114.114.114.114	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Destination IP	18	223.5.5.5	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	d9309050
File created	C:\Windows\SysWOW64\d9309050	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	d9309050
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	d9309050

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4464-0-0x0000000000810000-0x000000000089C000-memory.dmp	upx
behavioral1/files/0x000a00000001f15c-2.dat	upx
behavioral1/memory/4740-3-0x0000000000FE0000-0x000000000106C000-memory.dmp	upx
behavioral1/memory/4464-12-0x0000000000810000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4740-14-0x0000000000FE0000-0x000000000106C000-memory.dmp	upx
behavioral1/memory/4740-33-0x0000000000FE0000-0x000000000106C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\512688	d9309050
File opened for modification	C:\Windows\4c6ce0	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9309050
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	d9309050
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	d9309050
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	d9309050
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	d9309050
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	d9309050
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	d9309050
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	d9309050
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	d9309050
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	d9309050

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4740	d9309050
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Token: SeTcbPrivilege	4464	52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
Token: SeDebugPrivilege	4740	d9309050
Token: SeTcbPrivilege	4740	d9309050

C:\Users\Admin\AppData\Local\Temp\52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe
"C:\Users\Admin\AppData\Local\Temp\52c002f88150903218f4162a97c34b9cee9056a5da940b8df1b4fac7d68f99e1.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\Syswow64\d9309050
C:\Windows\Syswow64\d9309050
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d9309050

Path C:\Windows\SysWOW64\d9309050
Size 761KB
SHA256 17235bddad37ea5bf12262c7918af9bf3e8ce71475e9a0fb3584b290e02ed3f0
MD5 f328acf2b0b1f1165196794747bc36c5
SHA1 60bfab302dbf594c3837365c32849954c29919a3
SHA512 86885b3d770579097b1fdeeb37d3cdb910a7d4274ed995476ea289f2fd73cb1af2cce4036b7e364096c0da1efae2b0b8b033bfc8f4235e183cc862de13c95d1a
SSDEEP 12288:uSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:NvO2xJKRw2kOkxSkW298B
TLSH
T142F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-0-0x0000000000810000-0x000000000089C000-memory.dmp

Download

memory/4464-12-0x0000000000810000-0x000000000089C000-memory.dmp

Download

memory/4464-21-0x0000000003290000-0x00000000032EF000-memory.dmp

Download

memory/4740-3-0x0000000000FE0000-0x000000000106C000-memory.dmp

Download

memory/4740-13-0x0000000002550000-0x00000000025AF000-memory.dmp

Download

memory/4740-14-0x0000000000FE0000-0x000000000106C000-memory.dmp

Download

memory/4740-33-0x0000000000FE0000-0x000000000106C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads