0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2

General

Target
0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
Size 14.0MB
Sample260810-cae7mshj6s
SHA256 0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2
MD5 6ff8f43801922d4d85259cb1b4becfc0
SHA1 062a94c7156f5079a54f581b7816fc7bf362217d
SHA512 f56eb3c83d7ea1bafbb365995993ac11340fb8c691aca4d6eb7bbc3d4ae950a0f443f286720066af189d3cb68f04e16e7c5de793c34a337b2cb22c522ebcc731
SSDEEP 196608:XsoESlO1ayMjya0F0mMfX8wxkUqc5CM/Gk7SZWkeBiTgefVscr1S0JFu77M4Ve:XsDSlmkWaiz0fXqc63DT7fVlr1xMFVe
TLSH
T1C6E633BD628937A8C01ECA306623EC4D73B6651E17E1D9EEB5DF7B94BB1A440D801F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1920 created 4976	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	64

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5876	cmstp.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1920-0-0x0000000140000000-0x0000000141D5F000-memory.dmp	vmprotect

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4208	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5716	PING.EXE
4208	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5716	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
5876	cmstp.exe
5876	cmstp.exe
5876	cmstp.exe
5876	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
Token: SeDebugPrivilege	5876	cmstp.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 5876	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	90
PID 1920 wrote to memory of 4208	1920	0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe	91
PID 4208 wrote to memory of 5716	4208	cmd.exe	94
PID 4208 wrote to memory of 2024	4208	cmd.exe	95

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:4976
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5876

C:\Users\Admin\AppData\Local\Temp\0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe
"C:\Users\Admin\AppData\Local\Temp\0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & fsutil file setzerodata offset=0 length=14661120 "C:\Users\Admin\AppData\Local\Temp\0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe" > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe" & Del /f /q "C:\Windows\Prefetch\*.pf"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5716
- - C:\Windows\system32\fsutil.exe
    fsutil file setzerodata offset=0 length=14661120 "C:\Users\Admin\AppData\Local\Temp\0028c31649bfea781a94dde3be158f443121f476841049c171e0bf96cbc38fc2.exe"
    3⤵
    PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-0-0x0000000140000000-0x0000000141D5F000-memory.dmp

Download

memory/5876-4-0x00000156515C0000-0x00000156515C1000-memory.dmp

Download

memory/5876-9-0x00007FFB20000000-0x00007FFB20002000-memory.dmp

Download

memory/5876-16-0x0000015655A70000-0x0000015656817000-memory.dmp

Download

memory/5876-12-0x00007FFB1DF40000-0x00007FFB1DF42000-memory.dmp

Download

memory/5876-11-0x00007FFB1DF30000-0x00007FFB1DF32000-memory.dmp

Download

memory/5876-10-0x00007FFB20010000-0x00007FFB20012000-memory.dmp

Download

memory/5876-13-0x0000015655A70000-0x0000015656817000-memory.dmp

Download

memory/5876-17-0x0000015655A70000-0x0000015656817000-memory.dmp

Download

memory/5876-15-0x0000015655A70000-0x0000015656817000-memory.dmp

Download

memory/5876-8-0x00007FFB20420000-0x00007FFB20422000-memory.dmp

Download

memory/5876-7-0x00007FFB20410000-0x00007FFB20412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads