a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613

General

Target
a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Size 1022KB
Sample260723-eq5tca1blc
SHA256 a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613
MD5 720db154bc622253bf342b7ba688743c
SHA1 d8a98199dc7d0e79d92ada9bedae88949b11a7cb
SHA512 cb4e1850d28ab68080225e38058e287a801f0267171f16c15b650463a5d395f0efeba15a8e7613a3380017577db1fd1e036961f931f2b4a3e305539e17b2e731
SSDEEP 12288:cSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidT:vvO2xJKRw2kOkx2LFRvcU6UQOJdT
TLSH
T1DD256B31A681C036D5B34571C6FA4BBBA9747D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
632	aaa85adb

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Destination IP	4	223.5.5.5	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Destination IP	27	114.114.114.114	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Destination IP	28	223.5.5.5	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aaa85adb	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	aaa85adb
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	aaa85adb
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	aaa85adb
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	aaa85adb

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4544-0-0x0000000000210000-0x000000000029C000-memory.dmp	upx
behavioral1/memory/632-4-0x0000000000700000-0x000000000078C000-memory.dmp	upx
behavioral1/files/0x000500000001690d-3.dat	upx
behavioral1/memory/4544-12-0x0000000000210000-0x000000000029C000-memory.dmp	upx
behavioral1/memory/632-13-0x0000000000700000-0x000000000078C000-memory.dmp	upx
behavioral1/memory/632-18-0x0000000000700000-0x000000000078C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ad1f0	aaa85adb
File opened for modification	C:\Windows\4dcb80	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa85adb

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	aaa85adb
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	aaa85adb
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aaa85adb
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	aaa85adb
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	aaa85adb
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	aaa85adb
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	aaa85adb
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	aaa85adb
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	aaa85adb

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
632	aaa85adb
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Token: SeTcbPrivilege	4544	a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
Token: SeDebugPrivilege	632	aaa85adb
Token: SeTcbPrivilege	632	aaa85adb

C:\Users\Admin\AppData\Local\Temp\a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe
"C:\Users\Admin\AppData\Local\Temp\a4f50fb2b4bac6a01c2d57b8ca384df0c9cfa35b30657f91d1729b5c3dc05613.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\Syswow64\aaa85adb
C:\Windows\Syswow64\aaa85adb
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aaa85adb

Path C:\Windows\SysWOW64\aaa85adb
Size 1022KB
SHA256 bd35a423cad79c0a134794fda28ad382bdf44eb0f5eddb773b8d48a38697b6ed
MD5 9b109b50dd7d3541d6a2745dfc81f963
SHA1 9e3d65c4e61f18996611499d1077f754de475ba0
SHA512 a96100bf975c19b9a9707e701801b57bfe5247d4172b263da7a82b39e1bfbdb7e4361620d82acdad1da40e125786d70f7be3e031628335bbb8c589592c87151f
SSDEEP 12288:WSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidT:VvO2xJKRw2kOkx2LFRvcU6UQOJdT
TLSH
T1D3256B31A681C036D5B34571C6FA4BBBA9747D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad1f0

Path C:\Windows\ad1f0
Size 490B
SHA256 0e4a090285cb77f963e228deb2118a98113eb391e7fc8e94cc430f15093bf142
MD5 0e92cab047c1419ddb58db78f25d96e1
SHA1 b2210fb478eafeb7ac3fed0660162d1ec6aa3ca6
SHA512 53d4c7a0a9b6503e2ce22af2a868416f76b83a080af7910148243b677bf0c74749856dc78233e63150b929f25b074cc63ea524f198db345470ef1d773b90faef
TLSH
T162F097BFD0232569C3A28FB99E97AA6E7102903F424AB26618D97CC4488B394CC83008
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-4-0x0000000000700000-0x000000000078C000-memory.dmp

Download

memory/632-13-0x0000000000700000-0x000000000078C000-memory.dmp

Download

memory/632-18-0x0000000000700000-0x000000000078C000-memory.dmp

Download

memory/4544-0-0x0000000000210000-0x000000000029C000-memory.dmp

Download

memory/4544-12-0x0000000000210000-0x000000000029C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads