5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e

General

Target
5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
Size 944KB
Sample260730-a5py8awcph
SHA256 5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e
MD5 3cae1190a9fea6022ed6c2bfa39cbd0f
SHA1 40d2fd45ad590390321bbead1ef8b89e23477e07
SHA512 346e1bae28806ba06a36d7817a886ebbd8c2d33f326cd9428213167929dd8637f3c98522ed909b440bb3de4531e14616b74be3e5035100629569d20bae80a7a9
SSDEEP 12288:zNYl/0Val4vGewiuEhplWVzMu4I7x+I74TGP/jOXpwzNqVAIalcX9K8lWFcf6TGY:Il4vGd/IAt7b/yZwhXILf8NSk/v/hAwH
TLSH
T1BD25025AB1B580F5E16BC079CFD2925BE3B27445472093DF16A087BA1F177E0BD2A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4396	GameService.exe
2388	GameService.exe
2668	GameService.exe
5624	GameService.exe
5852	PiercingNetLink.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com
12	pastebin.com

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c3df-18.dat	upx
behavioral2/memory/5852-20-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp	upx
behavioral2/memory/5852-28-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp	upx
behavioral2/memory/5852-29-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GameServerClient\GameService.exe	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
File opened for modification	C:\Program Files (x86)\GameServerClient\GameService.exe	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
File created	C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
File opened for modification	C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
File created	C:\Program Files (x86)\GameServerClient\installc.bat	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
File opened for modification	C:\Program Files (x86)\GameServerClient\installc.bat	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1228	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe
2912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameService.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4888	1236	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe	89
PID 4888 wrote to memory of 1228	4888	cmd.exe	91
PID 4888 wrote to memory of 4396	4888	cmd.exe	92
PID 4888 wrote to memory of 2388	4888	cmd.exe	93
PID 4888 wrote to memory of 2668	4888	cmd.exe	94
PID 5624 wrote to memory of 5852	5624	GameService.exe	97
PID 1236 wrote to memory of 2912	1236	5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe	99

C:\Users\Admin\AppData\Local\Temp\5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe
"C:\Users\Admin\AppData\Local\Temp\5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\sc.exe
    Sc delete PiercingNetLink
    3⤵
    - Launches sc.exe
    PID:1228
- - C:\Program Files (x86)\GameServerClient\GameService.exe
    GameService remove PiercingNetLink confirm
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Program Files (x86)\GameServerClient\GameService.exe
    GameService install PiercingNetLink "C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2388
- - C:\Program Files (x86)\GameServerClient\GameService.exe
    GameService start PiercingNetLink
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  PID:2912

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe
  "C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe"
  2⤵
  - Executes dropped EXE
  PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

GameService.exe

Path C:\Program Files (x86)\GameServerClient\GameService.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
TLSH
T16954605263ED8A61F5F73F71683946210F36BCA19E3CC14E5390992E2CB1AA4DC747A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PiercingNetLink.exe

Path C:\Program Files (x86)\GameServerClient\PiercingNetLink.exe
Size 676KB
SHA256 e27ce7c560a6c43d7ad36a80797fcb07c401aa9195006a33df2a8ee2c982e923
MD5 cb4bdba09a7cc8eb82a299c458898235
SHA1 c09f233e068a308aeef227ee61738c34430c6485
SHA512 f796a0d2eb1f3a7d4bbe0d0baa4af438ab1c7006bfecc7579213e39b08ae010be9bc83b97b6426b17769784b9b997be44088f8c297346a539962f410d0f17fe3
SSDEEP 12288:lLVhMuKI73+I7cTGC/jhXQwzNqVABalcX3K9lWpcf6TGBxygvivlp96:ziwT7a/NgwhXBBg8pSX/vGp
TLSH
T109E423BD74F380F8E869C47ACBE2317EF42F5B195C86978E19927064499C3A453332A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installc.bat

Path C:\Program Files (x86)\GameServerClient\installc.bat
Size 232B
SHA256 e87b563c8111400c186ce0c91b99f88324191c2089ec23eca31351bcb37d25f0
MD5 136b0edf64df3c65d2c3760f9f4db68f
SHA1 c666a4a53bca8a1f905954b3bb6978c019f3c410
SHA512 02fd481314327565dbd64360d8b6e91056c2638c4c69027527b19f5f2c7a63265cb72fa4def24933f5b35d90851577ff52314886353e3bdaab0055152f4ca92e
TLSH
T10BD0A9BACACA2FF1C5C981B0748B130AD20B44C60C9872982D92290F41C3C65F23A02B
MD5 SHA1 SHA512 TLSH

Submit Download

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 300B
SHA256 8cc1dc1c4d8fe91dc95f4706b3d952a4b6a8d5ade7f26bd3708091959520aad4
MD5 de19da5276f9e22946ad7e2ec6b1df66
SHA1 76e1261dd1411f1f659e525a9ce757a1c4479f92
SHA512 e88581481e8d465bf246fe0108524bc454bffb22bfa1f75e192810119f9c80fa1775e58a6e1757eac672d6513c93e49c41293fcfbc99f4e3f949d00abacbdcea
TLSH
T1B8E0CD61888AC95D44CD507321E036CDA6A44C592F962B515B60CCD5685143DB5C7143
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5852-20-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp

Download

memory/5852-28-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp

Download

memory/5852-29-0x00007FF7D45F0000-0x00007FF7D4826000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads