024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe

General

Target
024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
Size 8.2MB
Sample260809-t283gabd48
SHA256 024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe
MD5 0d0142d53f88339c9a2808e43e5164b4
SHA1 50cb994e24ccac910b40bc7649475d159e8cc5c7
SHA512 0341a5c158ced19d3d931442cd80e749228a40062126a873ecbd07078d250d14dc9001b645255fc40117f79b7ce24fd047e1a39036aeb80fad9d0ac86b2cab3c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBW3:TDpbgBr/4QAMQMrEGRHsww7Q8RuW3
TLSH
T1E08633E6795E2ABBC20D1C798D16CD223A6C57B1C7549CE7FFD53EB60810C931A22D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3152	CoreSystem.exe

Executes dropped EXE 4 IoCs

pid	Process
1268	CoreSystem.exe
3152	CoreSystem.exe
4164	SystemHost.exe
5644	SystemHost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemHost.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	SystemHost.exe

Detect suspicious telegram bot 3 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000b00000001c647-15.dat	suspicious_telegram_bot
behavioral2/files/0x000b00000001c64a-76.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c64b-116.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
3152	CoreSystem.exe
3152	CoreSystem.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
1268	CoreSystem.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
5644	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe
4164	SystemHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 3152	5268	024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe	92
PID 1268 wrote to memory of 5644	1268	CoreSystem.exe	96

C:\Users\Admin\AppData\Local\Temp\024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe
"C:\Users\Admin\AppData\Local\Temp\024c80af6f55712b470f82e3370af6ce6e0b81b4f2ecc20bfbcbba66efb5d9fe.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5644

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4164
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  PID:1564

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 d9afffb27dc899d621a81b812bbaf3b129cee66590b03b039320b1038fc46703
MD5 3457ef120a111c5bb14fdb7ce48dc251
SHA1 3bdc7b3a78e934ba819770023a44ed8392be6c99
SHA512 c20cef62cbd9d1a87fba220d643be4f736916f7bf5b7dda8457b4c987d9c46e8d04e2ed60500236041d7a2f22043a0680eb7b20131e17fd21c6a6ca9bfaba1d6
TLSH
T19F41B7CD2E18B465BF469E864AB9CA373D38F1D4D050009135FB84A230AAFC56D6F84C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 ab46ceb519bdc140c847a8817bb05d132c6b9bbeb6438f29fc569bee0cea0366
MD5 042ee028de1b727be1755e3ea480c650
SHA1 f1f9dd3c63ecd415a239b6d783325255b7a59b6a
SHA512 8f1d4ec069541d0ac5566df6c2c5a52524a1dd6424094360dc0cf4fb243f64537b98d58f079dc4bbc99fe5c2012e30f2698a964b3c4883b37e7bb3dc915427f0
TLSH
T1E341F8DB0A0A38549F41DF8AABF8C9771E3884A442841D82F4BBC8D5248D7426D4F44C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 efc669b6a32ce81174bcfe14feac577be5507583d348dd348b215afaf63e18d3
MD5 1b2281cd2f7c52bfa08fbb9e7c14d29b
SHA1 c292c2f2cc52540c3f54990fa86b8fb8f4a5ece0
SHA512 d496ac21d6b2565ee9770eb654ed7f76bbd1cac6a097a50f0fcea3f83d1436cd275764b8094fa02a2a218e6cc91b999c62fbb28233cd0762fa1edffae39ca2db
TLSH
T196F0223539FA507BF037AE7943C225B6062AA22731163BB82AB013042A02E206C81606
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 309546b8594830884a802682985f350b6b3cb9e0c2e064981ccabe72a0178814
MD5 ee77159d694666602e9a19a7b6e9e274
SHA1 e611406c42b03f1dff22599cb6445739f6d976e8
SHA512 0b83e07b7994b6d0a9b9f99d0d1abb9aad277172a3c4a5f1064c6fbe7ac7097423678f07eefe257f2cdd97c09d11a7a2964e1ee9f92a508ac9efdb096283b007
TLSH
T16AF02B3864AB412EF672E7BE42C517D58627F23731182A596FB3530D2D07E80BA70D29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
Size 8.4MB
SHA256 4e9453276ed036ebb32f8af62056a341cbf37b547a7cf5e0b246df95b7761d5c
MD5 cd8b719194636eba5ec60f5332eaadca
SHA1 1d1f88a36aff2a3a2757c9e372e33303a46ec023
SHA512 1bf5e9f031c9260500a9c724b6449cbe9c99aa7a7f14b539cdade6b528eff97b31c55d3dc297c09fde96d7a8749d2846ec7168d4e42080b1d43348b6a67d6d1a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBW4E+:TDpbgBr/4QAMQMrEGRHsww7Q8RuW4D
TLSH
T1669633E6795E2AB7C20D1C798D16CD223A6C57B1C7549CE3FFD53DB60910C931A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 8.3MB
SHA256 e58659bb5941c64cbcd6e146f3e6579352210344d48a67387b88681076ad2fb3
MD5 70018838603a297bc0500fb63064828e
SHA1 3d1fb257307f1a31893771d96ba4e9ec746ca579
SHA512 e325bceffe1d6e91eac6573c734171726436db1a584ec82df9c0528bbb5facc2938fa98e7e47b1dfc6a1c9ad2c9287096932cb402343c95ec10b19cfc1b0c2c3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBW4d:TDpbgBr/4QAMQMrEGRHsww7Q8RuW4d
TLSH
T1C09633E6795E2ABBC20D1C798D16CD223A6C57B1C7545CE3FFD53EB60910C931A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 8.5MB
SHA256 77aca2863b4a08d5f61e593af7d8b30def1a3850ad0a612fb605704c4bbca2c3
MD5 b502f1fb148581f1c2289b5969512833
SHA1 e37c637bd6569e0e514a291bbe6d8d9c97a556a9
SHA512 51a28beb34f0f5ca8d1552b5fba0ccd4ca1f1773b61c81ff8848c3008d9cb68b826751a2d7a0f43e45ea5fc1bba2ff924afe0604c0a93a6e05cbecf706f9c076
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBW4Ez:TDpbgBr/4QAMQMrEGRHsww7Q8RuW4+
TLSH
T16F9633E6785E2AB7C20D1C798D16CE223A6C57B1C7545CE7FFD53DB60910CA31A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads