c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4

General

Target
c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Size 3.0MB
Sample260528-tfg2vsft5w
SHA256 c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4
MD5 dfda8e0878ea8fef02f02e340e128291
SHA1 f4d9a64f4e33517e058f1bdb7ddf4a4d3214be36
SHA512 f4a5caa6dbd4fab498eb6d5a1733dfff2c55d58b77619c289fa231b0c7c53120d1eef4e4b51c6cead515df621ee583c0cbde0185df81a347bd3c2d402ad65610
SSDEEP 49152:ZA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:u/whnLrHp/qKm2/Sb/
TLSH
T108E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4236	837154c0
4024	837154c0

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Destination IP	2	223.5.5.5	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Destination IP	35	114.114.114.114	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Destination IP	92	114.114.114.114	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Destination IP	93	223.5.5.5	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\837154c0	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2328-0-0x0000000000560000-0x0000000000865000-memory.dmp	upx
behavioral2/files/0x0009000000025ad7-2.dat	upx
behavioral2/memory/4236-3-0x0000000000370000-0x0000000000675000-memory.dmp	upx
behavioral2/memory/4236-4-0x0000000000370000-0x0000000000675000-memory.dmp	upx
behavioral2/memory/4024-6-0x0000000000370000-0x0000000000675000-memory.dmp	upx
behavioral2/memory/4024-7-0x0000000000370000-0x0000000000675000-memory.dmp	upx
behavioral2/memory/2328-16-0x0000000000560000-0x0000000000865000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5924	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5104	4236	WerFault.exe	81
2128	4024	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
Token: SeTcbPrivilege	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 5924	2328	c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe	85

C:\Users\Admin\AppData\Local\Temp\c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe
"C:\Users\Admin\AppData\Local\Temp\c260c0460e98d4a06c556b2269629fc39e91cdd4aeb67a2d8a1f8dc107296cf4.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\sc.exe
  sc.exe start 4COu4Rw7tA8
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5924

C:\Windows\Syswow64\837154c0
C:\Windows\Syswow64\837154c0
1⤵
- Executes dropped EXE
PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 152
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4236 -ip 4236
1⤵
PID:5932

C:\Windows\Syswow64\837154c0
C:\Windows\Syswow64\837154c0
1⤵
- Executes dropped EXE
PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 148
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4024 -ip 4024
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

837154c0

Path C:\Windows\SysWOW64\837154c0
Size 3.0MB
SHA256 c889829a39cb56f7ef349b636379d32a46bb5bb8d39530dead9e8775cd0a6cc8
MD5 53e4b99384eb6c950c4a827f056d082e
SHA1 1e5adf1149174bddcfbd0b0051a468e546f85a63
SHA512 5957c784b2e8699dccadc882ee3e9e00e56fb1e8769d494857ac11ae36e25e6453cee4501009ba44b7fb91eb542906c255bfde302313b954304772a03af48fdb
SSDEEP 49152:sA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:r/whnLrHp/qKm2/Sb/
TLSH
T11AE55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2328-0-0x0000000000560000-0x0000000000865000-memory.dmp

Download

memory/2328-16-0x0000000000560000-0x0000000000865000-memory.dmp

Download

memory/4024-6-0x0000000000370000-0x0000000000675000-memory.dmp

Download

memory/4024-7-0x0000000000370000-0x0000000000675000-memory.dmp

Download

memory/4236-3-0x0000000000370000-0x0000000000675000-memory.dmp

Download

memory/4236-4-0x0000000000370000-0x0000000000675000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads