6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c

General

Target
6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe
Size 8.1MB
Sample260809-s9fkfs1cng
SHA256 6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c
MD5 d5f8723304d1d653047a8d8603af3dbe
SHA1 7b868034b4e41c8220c7937f7d664e21a995c12f
SHA512 6f1fbc5b85af6b9cf5d05769d80418f07a3c04fbb678bf0702a7c6d74384fd07ed50a2720ea4d2c0c3989a5e501ccbad706a4906f8acd02f1bb47bb8c35fa6bc
SSDEEP 49152:lVtrQqgJe0G6cda2UaQqcU69HVt/ILjJzvBGvRikbkMpsVWDgzvTdRLGvFHU/EZ0:lV2MrIdaQM4VtGmRCM5mZ/2zb2WW
TLSH
T1E3862891F9DF54F5DA03183148ABA23F27306E054B24CBC7EB507F69E877AA21933619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4796	netsh.exe
4388	netsh.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.co
15	ifconfig.co

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
2784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	route.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5748	6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 3084	5748	6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe	90
PID 3084 wrote to memory of 4796	3084	cmd.exe	91
PID 5748 wrote to memory of 2784	5748	6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe	92
PID 2784 wrote to memory of 4388	2784	cmd.exe	93
PID 5748 wrote to memory of 4336	5748	6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe	94

C:\Users\Admin\AppData\Local\Temp\6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe
"C:\Users\Admin\AppData\Local\Temp\6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "netsh advfirewall firewall del rule name=\"openp2p\""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall del rule name=\"openp2p\"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "netsh advfirewall firewall add rule name=\"openp2p\" dir=in action=allow program=\"C:\Users\Admin\AppData\Local\Temp\6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe\" enable=yes"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name=\"openp2p\" dir=in action=allow program=\"C:\Users\Admin\AppData\Local\Temp\6d57baec1658ec84ff45cff08169c9ac572fa0852007bc3733f07300f134ab7c.exe\" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4388
- C:\Windows\SysWOW64\route.exe
  route print -4
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336