d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809

General

Target
d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe
Size 7.2MB
Sample261002-v5hkcssbjd
SHA256 d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809
MD5 7a0175c35de37827958313318560f01e
SHA1 44904124b5a82d78ec203e9b82256559fe4d7f32
SHA512 ff7d6a9a739470651f23e9ded20b0fb6e5c8310d44455e7418dfff42a5a7756b1325dbc009c86c132790b161aa1a0de5ed38f4c2204cc19fd99a8740d1853acc
SSDEEP 98304:LeRLZpNct/Ujn6LdxYkPXo+GOKkT3JkLoEL78woli84Lqd1Zh3DLLA1xZUI2JSww:8ZpNctMj6LdxYf63JXKod4QZnLgUY
TLSH
T12E769D20E711D02BF8E300B1D67D57AE5558AB30035504DBB3CC6E9E6BB5AD2BB32A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2192	netsh.exe
1752	netsh.exe

Loads dropped DLL 1 IoCs

pid	Process
1260	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1260	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2192	1260	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe	86
PID 1260 wrote to memory of 1752	1260	d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe	89

C:\Users\Admin\AppData\Local\Temp\d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe
"C:\Users\Admin\AppData\Local\Temp\d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\d54c179d1e130d98655427a9dac4db42ccd962840a5d4688bc6e3098c583a809.exe" action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lx7z.dll

Path C:\Users\Admin\AppData\Local\Temp\Lx7z.dll
Size 1.3MB
SHA256 8dd93adc6e06cb7a404d259e59b644ad49b69a5d4215de607baf659fabfb2c4c
MD5 7d87505250aaec05904237c2504fcd12
SHA1 a8458f050caad158cdaec97961bd0333e51157bf
SHA512 db467538ae23eedac1c8d9425cdc70a1ab75d60e9f3306beeb3f05d0f1486e5ff16e7bb336295f68a6c167238d5d3d563e6afe28f64fca8ef22299248c321a30
SSDEEP 24576:41NPh3viamBHlR3QAc0E6Y59atbXLrmWt+xpI8CNoGXMYHv9ww7r:41Zh3eRJcL688zO01v9wMr
TLSH
T16D559D11F7F2C074C58E5630862DBBBA50F8E729CA1068D777C0BE6E6F319D2D225A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads