c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5

General

Target
c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe
Size 2.3MB
Sample260810-mpzvpsfe72
SHA256 c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5
MD5 88fa6c3e55009236059c8c9256b5bdb2
SHA1 464151b6b73404689e7af32e3e8f5aeb32b4d885
SHA512 dd9e71c7e1d946217618fb7b2e3956e2f23302e7dede2faaeb70c9e4105d52f053168ebdc2d2d511f0f30c709cd3993d774d70b3d996bde53ff5139a8b8efe8f
SSDEEP 49152:TaeANSovXmkr87pd6QcBn9N4P0OxvDbtWqVdR/bZLa7m/fLww:lOTfgNExN4boq/NVfLww
TLSH
T175B5F12322A14092F1F25931867A6EB47AF276A54C71D87F43E9DCD42E237E0EB12747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
432	NqyaYdUB.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CM.dat	NqyaYdUB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3276	cmd.exe
1360	cmd.exe
3776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NqyaYdUB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NqyaYdUB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	NqyaYdUB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5848	c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 432	5848	c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe	90
PID 5848 wrote to memory of 404	5848	c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe	92
PID 432 wrote to memory of 1360	432	NqyaYdUB.exe	94
PID 432 wrote to memory of 3776	432	NqyaYdUB.exe	95
PID 432 wrote to memory of 3276	432	NqyaYdUB.exe	96
PID 3276 wrote to memory of 3592	3276	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe
"C:\Users\Admin\AppData\Local\Temp\c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\NqyaYdUB.exe
  "C:\Users\Admin\AppData\Local\Temp\NqyaYdUB.exe" -renamed
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    /c ver
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3776
- - C:\Windows\SysWOW64\cmd.exe
    /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\State" /v UEFISecureBootEnabled
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\State" /v UEFISecureBootEnabled
      4⤵
      System Location Discovery: System Language Discovery
      PID:3592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C60A6B~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NqyaYdUB.exe

Path C:\Users\Admin\AppData\Local\Temp\NqyaYdUB.exe
Size 2.3MB
SHA256 c60a6b5afc5c4fe096841b137907db3d33ee642e9d1cbd5c72596dac695812f5
MD5 88fa6c3e55009236059c8c9256b5bdb2
SHA1 464151b6b73404689e7af32e3e8f5aeb32b4d885
SHA512 dd9e71c7e1d946217618fb7b2e3956e2f23302e7dede2faaeb70c9e4105d52f053168ebdc2d2d511f0f30c709cd3993d774d70b3d996bde53ff5139a8b8efe8f
SSDEEP 49152:TaeANSovXmkr87pd6QcBn9N4P0OxvDbtWqVdR/bZLa7m/fLww:lOTfgNExN4boq/NVfLww
TLSH
T175B5F12322A14092F1F25931867A6EB47AF276A54C71D87F43E9DCD42E237E0EB12747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5848-0-0x0000000010000000-0x00000000101E6000-memory.dmp

Download

Analysis

Sharing