e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063

General

Target
e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Size 2.6MB
Sample260511-yclcbshs5x
SHA256 e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063
MD5 aaa8306586f5bb788fe9e24e53408aea
SHA1 3302b26780d52a7614f38fdf59ed5e9f6e370e68
SHA512 e8619fcd81cbdb118182b2a8435b72a86556eaf5c1236efccb68833eff0fc9e61ea691cff6243b8c2454ed9e866b8d61fabfada390be9d6c90e28674ff0dd885
SSDEEP 49152:0TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:0KkVkOhCXHHFZMjHfUKkVWsM0r1F
TLSH
T10EC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4484	d9b4502f

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Destination IP	6	223.5.5.5	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Destination IP	39	114.114.114.114	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Destination IP	40	223.5.5.5	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	d9b4502f
File created	C:\Windows\SysWOW64\d9b4502f	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	d9b4502f
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	d9b4502f

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4460-0-0x0000000000A80000-0x0000000000B09000-memory.dmp	upx
behavioral1/files/0x0008000000024448-2.dat	upx
behavioral1/memory/4484-3-0x0000000000520000-0x00000000005A9000-memory.dmp	upx
behavioral1/memory/4460-16-0x0000000000A80000-0x0000000000B09000-memory.dmp	upx
behavioral1/memory/4484-18-0x0000000000520000-0x00000000005A9000-memory.dmp	upx
behavioral1/memory/4484-22-0x0000000000520000-0x00000000005A9000-memory.dmp	upx
behavioral1/memory/4460-33-0x0000000000A80000-0x0000000000B09000-memory.dmp	upx
behavioral1/memory/4484-34-0x0000000000520000-0x00000000005A9000-memory.dmp	upx
behavioral1/memory/4484-38-0x0000000000520000-0x00000000005A9000-memory.dmp	upx
behavioral1/memory/4460-43-0x0000000000A80000-0x0000000000B09000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4cc488	d9b4502f
File opened for modification	C:\Windows\4c5b58	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9b4502f

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	d9b4502f
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	d9b4502f
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	d9b4502f
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	d9b4502f
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	d9b4502f
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	d9b4502f
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	d9b4502f
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	d9b4502f
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	d9b4502f

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4484	d9b4502f
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Token: SeTcbPrivilege	4460	e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
Token: SeDebugPrivilege	4484	d9b4502f
Token: SeTcbPrivilege	4484	d9b4502f

C:\Users\Admin\AppData\Local\Temp\e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe
"C:\Users\Admin\AppData\Local\Temp\e73ec0ef11da0b2cf4eaf584cf39bbf7de9ae6860cb9dcea17336b3b744cf063.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\Syswow64\d9b4502f
C:\Windows\Syswow64\d9b4502f
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d9b4502f

Path C:\Windows\SysWOW64\d9b4502f
Size 2.6MB
SHA256 f0d59b13f5d367f686b6d42642d370215f56685e581a0747648569a551c3c7e2
MD5 a5cbd2357368498343f960f14f6093a0
SHA1 c10666087038d96b74779d38cdb3ef0f923fa239
SHA512 943ce7792fe50a89e5608fb25f1601af45d40a74b597285c3f049ef8a57df29fc20d42c2b45083444616d82d259c980502b91aa2845c047c303e86e0e5a39c3e
SSDEEP 49152:5TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:5KkVkOhCXHHFZMjHfUKkVWsM0r1F
TLSH
T132C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4460-0-0x0000000000A80000-0x0000000000B09000-memory.dmp

Download

memory/4460-16-0x0000000000A80000-0x0000000000B09000-memory.dmp

Download

memory/4460-33-0x0000000000A80000-0x0000000000B09000-memory.dmp

Download

memory/4460-43-0x0000000000A80000-0x0000000000B09000-memory.dmp

Download

memory/4484-3-0x0000000000520000-0x00000000005A9000-memory.dmp

Download

memory/4484-18-0x0000000000520000-0x00000000005A9000-memory.dmp

Download

memory/4484-22-0x0000000000520000-0x00000000005A9000-memory.dmp

Download

memory/4484-34-0x0000000000520000-0x00000000005A9000-memory.dmp

Download

memory/4484-38-0x0000000000520000-0x00000000005A9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads