50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723

General

Target
50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe
Size 9.9MB
Sample260824-mfbfrawdld
SHA256 50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723
MD5 ea1823827aebd18bdbb8e75f2d93d13e
SHA1 8454f263d8b60b54e6d9be4f44dc89ef4242604b
SHA512 19d49eafda62551438fba55846721ae8d45c689997d37f1cecee44b813cb2b21b902056cbf8587559cfa1fb172812efbc077a554f751276b671f8b6bdcd2ac08
SSDEEP 196608:gYtdjnoUY2mIuMj1oiJ8vm+9vpUQu8E85QBry9kkG+EdPW2v1NkG2VOZf6zZa:rFnoiygH8vmOU5T8iBG9nmPW2vLh1R6g
TLSH
T1CEA63341B01C8C69D862253737F30CA55DC526D36A95BC96113EFAB41FFE3CA72A90B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe

Executes dropped EXE 4 IoCs

pid	Process
2380	eidolon.exe
3804	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe
5868	USBServers32.exe
3592	USBServers32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2128	cmd.exe
4244	cmd.exe
6016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2380	4800	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe	85
PID 4800 wrote to memory of 6016	4800	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe	86
PID 4800 wrote to memory of 2128	4800	50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe	88
PID 2128 wrote to memory of 3804	2128	cmd.exe	90
PID 2128 wrote to memory of 5868	2128	cmd.exe	94
PID 5868 wrote to memory of 4244	5868	USBServers32.exe	95
PID 4244 wrote to memory of 1392	4244	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe
"C:\Users\Admin\AppData\Local\Temp\50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe
    "C:\Users\Admin\AppData\Local\Temp\50ccd2abedc496d06aa20b784068b95e364a99de97691e4468779bcdc9e9c723.exe"
    3⤵
    - Executes dropped EXE
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
    "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1392

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 9.7MB
SHA256 9e2723abf2c518d402016dbd11e2663cd5a491c2464c1e06dfef082ff2cb0af5
MD5 f7e1b110701a7bb87ebf853b96694ef0
SHA1 08ffcfe7388d0b70430c7912e320a3859d7ce946
SHA512 0e8fdf10b44143234e401bf735436060555225548e618a2fcc98488301c6b91680e34dd7eb2814f5c25968f8105301a00d3112edb9d42704b89b569babfaf83e
SSDEEP 196608:xVkR5Fj9zqmBBQujS8ILAsAmSR0RYRplK:8DFNjS8ILAsApR0RY
TLSH
T188A65B61FA9EAAB5D882587D609E357F9224E701031948F3A7E02A45FE707F359B31C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 619B
SHA256 e01b35d0929c00c80248d1cbc6283cbed5dbe0602ec62af1fadb62b5a8d18c23
MD5 2589c0fdd88950f50cbf25e576b9b926
SHA1 d3ef0c4dcbae776456697ebbccbb38fcf03a6456
SHA512 0c5e6f8ae96de77a1f07fb3eb523130957d96b48453a876fb519b1ee51574339c50e0b8c2649c4392070865452bf77475dbeb92eea4e3650c18c7a5350fc0316
TLSH
T18BF0D62341F786E95C6DE4F74B66A20EA220941E7FA51F200F65450F70B188FBE93242
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 327B
SHA256 3440596321cf23feddaf053fcee24ec5c5c8c02c1dc712add18574da1d506223
MD5 76816adc3b9596e8a3eb98aae2f02ff4
SHA1 e815956c2259690f39aa2c0edd95adc6caf924f0
SHA512 fa77a128fe6b098af03550253a108f07cff4050dd8ced64980042d08055f6d3af02dd96c9c5edb4378c7aa8ca0095e41e2ebbd98eca69ac2b6039e467cda390b
TLSH
T142E0262718F747C99C3DE0F7D777620AA214A04E2F660A300E26041FB0B148EADD3542
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads