46aecd3012f7f1cf0413372a77b49da76d4f6a91757f63831ead3506d1ce2549

General

Target
Setup.exe
Size 1.5MB
Sample261002-eltkhsgf84
SHA256 46aecd3012f7f1cf0413372a77b49da76d4f6a91757f63831ead3506d1ce2549
MD5 6d9c968f267a94b9a9c6895ff6540cc0
SHA1 140fa522cc88e4bd3ae3867ce7ee509929867634
SHA512 ae75fca8eafccc9a201b530a21d5d75d6ed3ddcac5ab5ba8c15fb73ab5ce2b9a5c3336c17a1dc2800789ad3aac9d6d30ad1b2efab71290b634647ea7bb5b371e
SSDEEP 49152:ve75tpAKsPRgXQY9GWBSKPkeAxOH24VwoD:ve75tpAKsPRgg0zBeXsbdD
TLSH
T1AA75231BBAD0E2B1C232D0389F08A171F79158071A899E47FF5CA2530FB7715E89B799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4036	netsh.exe
3336	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4100	rasui32.exe
6140	rasui32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rasui32.exe	Setup.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rasui32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rasui32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rasui32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rasui32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rasui32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rasui32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rasui32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rasui32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rasui32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6140	rasui32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 4100	236	Setup.exe	88
PID 6140 wrote to memory of 4036	6140	rasui32.exe	90
PID 6140 wrote to memory of 3336	6140	rasui32.exe	92

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\SysWOW64\rasui32.exe
  "C:\Windows\system32\rasui32.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4100

C:\Windows\SysWOW64\rasui32.exe
"C:\Windows\SysWOW64\rasui32.exe" /s /p 27016
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="rasui32.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4036
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall add rule name="rasui32.exe" dir=in action=allow program="C:\Windows\SysWOW64\rasui32.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rasui32.exe

Path C:\Windows\SysWOW64\rasui32.exe
Size 1.5MB
SHA256 46aecd3012f7f1cf0413372a77b49da76d4f6a91757f63831ead3506d1ce2549
MD5 6d9c968f267a94b9a9c6895ff6540cc0
SHA1 140fa522cc88e4bd3ae3867ce7ee509929867634
SHA512 ae75fca8eafccc9a201b530a21d5d75d6ed3ddcac5ab5ba8c15fb73ab5ce2b9a5c3336c17a1dc2800789ad3aac9d6d30ad1b2efab71290b634647ea7bb5b371e
SSDEEP 49152:ve75tpAKsPRgXQY9GWBSKPkeAxOH24VwoD:ve75tpAKsPRgg0zBeXsbdD
TLSH
T1AA75231BBAD0E2B1C232D0389F08A171F79158071A899E47FF5CA2530FB7715E89B799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-0-0x0000000002470000-0x0000000002570000-memory.dmp

Download

memory/236-1-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/236-15-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4100-5-0x00000000023E0000-0x00000000024E0000-memory.dmp

Download

memory/4100-14-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/6140-13-0x0000000000F40000-0x0000000001040000-memory.dmp

Download

memory/6140-16-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/6140-17-0x0000000000F40000-0x0000000001040000-memory.dmp

Download

memory/6140-18-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads