87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb

General

Target
87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
Size 4.9MB
Sample260825-j43ncsfp8t
SHA256 87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb
MD5 c79cc2fe6e12669b0a888a0a9018ed19
SHA1 87306d026b33fc209f8fad2e48d5c7dca394477f
SHA512 bfa29feda48c25800d79a1e8bc0ce620ae0d91bede5ce26012523a76925a76f342782ca942a49ae9a12fb298a08ca6004acea2099f8c8f593582291591dee149
SSDEEP 49152:+o0N7ni9RjDBkHtBrFsnG+9RJAKKLnb0I2f4jmAAgGpqg6A:GN7niHjDBkH75GLAbzn2f+mAMpS
TLSH
T137364C70B340863DC01C437B79A9FE34A32D6093BAD2CDBED1945DA91C62DE66E4B187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4180	1e2.exe
5548	1.exe
6076	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\1.exe"	1e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = " C:\\1.exe"	1e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\1.exe"	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\1.exe"	1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001400000001c462-4.dat	upx
behavioral2/memory/4180-5-0x0000000000400000-0x0000000000534000-memory.dmp	upx
behavioral2/memory/5548-9-0x0000000000400000-0x0000000000534000-memory.dmp	upx
behavioral2/memory/6076-15-0x0000000000400000-0x0000000000534000-memory.dmp	upx
behavioral2/memory/4180-17-0x0000000000400000-0x0000000000534000-memory.dmp	upx
behavioral2/memory/5548-18-0x0000000000400000-0x0000000000534000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4244	2400	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
4180	1e2.exe
4180	1e2.exe
5548	1.exe
5548	1.exe
5548	1.exe
5548	1.exe
5548	1.exe
5548	1.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
4180	1e2.exe
4180	1e2.exe
5548	1.exe
5548	1.exe
6076	1.exe
6076	1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4180	2400	87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe	89
PID 4180 wrote to memory of 6076	4180	1e2.exe	93

C:\Users\Admin\AppData\Local\Temp\87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe
"C:\Users\Admin\AppData\Local\Temp\87fb1e157d956b77dce60e89496fcc9beb289f3b3beeb1e7dc2ef3ae14b77aeb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- \??\c:\1e2.exe
  c:\1e2.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4180
- - \??\c:\1.exe
    c:\1.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 928
  2⤵
  - Program crash
  PID:4244

C:\1.exe
C:\1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2400 -ip 2400
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e2.exe

Path C:\1e2.exe
Size 388KB
SHA256 d920bbb6dfca89122e604774f6e457b9104dd29aff4e8b77c7770883390e399b
MD5 8232061cb3d1e61eb86dfc1cf428b4d5
SHA1 26690509b0af5148d5298174fcc82edfa492d6e3
SHA512 26a5745195ae6c9f274bb69cabcf354f7c36d9b1b3356bb3b96ba6b9d612f31c44cbe383837ca2497ef288953f539d453cd053707ac8e15d666a126c817e08dc
SSDEEP 6144:24ZTIynEcEL/3ph6/IjAYzkANii4U6BTESfODdrVkFWqILtTvXmEz:24Z0cETQ/YzOlPfO5rKfIVv2c
TLSH
T101842281BDEE286CC8752939705BDE24C610A514888E0EDB25C9F4DC3A67390BDDAD7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11.ini

Path \??\c:\11.ini
Size 57B
SHA256 0d6e11c31ccb78234075883312bb7615103253485641ba547f6f9cdacf589bf4
MD5 5ff37e939f144b64320423854ca2a661
SHA1 bd10946da7d6362961c6adcad95de862892381a2
SHA512 30e8d3a3d9311a0f3cdecb1b1d942bc69ddeb421232a21ee7b10dec92412a20130d2fa0a658fc017b38228d0635c96257e02b99e1831de2176ae4b1ec6ef4e0b
TLSH
T11C90026A501468878A0100B696121AE0AA0C44D25A6FF862511B922307D623E93183C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4180-5-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4180-7-0x0000000000533000-0x0000000000534000-memory.dmp

Download

memory/4180-17-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/5548-9-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/5548-18-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/6076-15-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads