ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e

General

Target
ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Size 2.1MB
Sample260601-lll9rsgv21
SHA256 ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e
MD5 912157b98ade1773db0daf4846f28e8b
SHA1 4ee4e13879deee0bda72f8536004db26ca8adc38
SHA512 179d31eda61791edb9f1364093a9a79fb8d269d2bb4c3f75b067975ad0e338dacfebda9ec1a839c7eabd2547ad0cad26c9cce7c36ba47844a82a971947ab2ba7
SSDEEP 49152:CHHKO2FQd1oOU82lPJ6PsfsCWFn5+ovhnFvTGkQdh:CnKl2qOb2lP8ssYoJxKkyh
TLSH
T189A5BF12F7A1C072C4A7427189BB876EF674BD1157218ACBA3C03A5A5EB33D27E35309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3412	4c03e248

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Destination IP	4	223.5.5.5	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Destination IP	50	114.114.114.114	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Destination IP	52	223.5.5.5	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	4c03e248
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	4c03e248
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	4c03e248
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	4c03e248
File created	C:\Windows\SysWOW64\4c03e248	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\3a6a28	4c03e248
File opened for modification	C:\Windows\425bc8	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c03e248

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	4c03e248
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	4c03e248
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	4c03e248
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	4c03e248
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	4c03e248
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	4c03e248
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	4c03e248
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	4c03e248

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3412	4c03e248
3412	4c03e248
3412	4c03e248
3412	4c03e248
3412	4c03e248
3412	4c03e248
3412	4c03e248
3412	4c03e248
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Token: SeTcbPrivilege	3876	ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
Token: SeDebugPrivilege	3412	4c03e248
Token: SeTcbPrivilege	3412	4c03e248

C:\Users\Admin\AppData\Local\Temp\ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe
"C:\Users\Admin\AppData\Local\Temp\ef42cc06c7a4edd81c1459b0db890eccdadc4de8f836b59710c95df50659c54e.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\Syswow64\4c03e248
C:\Windows\Syswow64\4c03e248
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4c03e248

Path C:\Windows\SysWOW64\4c03e248
Size 2.1MB
SHA256 bb53d9ff5ed75e0b77806184c6a7c7f69224321cc6407f4b98f557efddea98f7
MD5 69d76ad612b4202f813b6c73cf56b597
SHA1 5463f7fe4084669244b44e589ed743ba98d688f9
SHA512 82db17ea09f9d6a66667b99fc0615cb25868bfd95ed93d527ad84595e537f855929793450c615b2f0fd6c0a251b15c86f3f72e9cb710d8154ca20b13bb680752
SSDEEP 49152:XHHKO2FQd1oOU82lPJ6PsfsCWFn5+ovhnFvTGkQdh:XnKl2qOb2lP8ssYoJxKkyh
TLSH
T128A5BF12F7A1C072C4A7427189BB876EF674BD1157218ACBA3C03A5A5EB33D27E35309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-4-0x0000000000610000-0x0000000000673000-memory.dmp

Download

memory/3876-0-0x0000000000220000-0x0000000000283000-memory.dmp