87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411

General

Target
87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
Size 5.7MB
Sample260808-m5ppnsvhpg
SHA256 87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411
MD5 84d84bc128a2b5390b3dcdafd4c0ac1b
SHA1 8acf1274878c6964954e80b0611d6c551a1efb07
SHA512 fd81d3ea5bb2827568bf0453489059eb70bb38f25fe322a9bfdcffc1853f814c1c098aced11f3181f9715c6c1a72bb9e6e8a159da5fa5ec6a8a2ec19d435c519
SSDEEP 49152:YF06l4ufGDQlsmgnWPVaY6bS4mzcBamujeVdOAEAAz0jjbXCD/jKJ0o:YFhJfmnuz6lmIBaKUAhAz0jjbXCD/jK
TLSH
T1F4566D26EA948982CD5D06FC56D3516007BECC87DA42E71B2AACFC673EA93314DC14DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3464	ping.exe

System Network Connections Discovery 1 TTPs 8 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1288	netstat.exe
1456	netstat.exe
1592	netstat.exe
4908	netstat.exe
4716	netstat.exe
3600	netstat.exe
5072	netstat.exe
2656	netstat.exe

Gathers network information 2 TTPs 8 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1592	netstat.exe
4908	netstat.exe
4716	netstat.exe
3600	netstat.exe
5072	netstat.exe
2656	netstat.exe
1288	netstat.exe
1456	netstat.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3464	ping.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
Token: SeDebugPrivilege	3600	netstat.exe
Token: SeDebugPrivilege	5072	netstat.exe
Token: SeDebugPrivilege	2656	netstat.exe
Token: SeDebugPrivilege	1288	netstat.exe
Token: SeDebugPrivilege	1456	netstat.exe
Token: SeDebugPrivilege	1592	netstat.exe
Token: SeDebugPrivilege	4908	netstat.exe
Token: SeDebugPrivilege	4716	netstat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3464	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	86
PID 1388 wrote to memory of 3600	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	88
PID 1388 wrote to memory of 5072	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	90
PID 1388 wrote to memory of 2656	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	92
PID 1388 wrote to memory of 1288	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	94
PID 1388 wrote to memory of 1456	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	96
PID 1388 wrote to memory of 1592	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	98
PID 1388 wrote to memory of 4908	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	100
PID 1388 wrote to memory of 4716	1388	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	102

C:\Users\Admin\AppData\Local\Temp\87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
"C:\Users\Admin\AppData\Local\Temp\87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SYSTEM32\ping.exe
  "ping" baidu.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3464
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4716