8b70c76b061b1cf63db7f5081927bb2f9639c810f030b34f9bd73dc70466ef08

General

Target
天问Block 编译器更新补丁-202609.exe
Size 1.8MB
Sample261003-kt6spsvcrd
SHA256 8b70c76b061b1cf63db7f5081927bb2f9639c810f030b34f9bd73dc70466ef08
MD5 dc9e5644bdabf1e51c14a4513b302c01
SHA1 05c11d05c9bf8352674930d29fda2290d14dbc43
SHA512 f561e00a04f271823e58197bf7236bfb1da6ef7e40bd924b39f0a2153a01125fb50748e7f79cac7cf75428b97a67d02385282014af4430a31280d7876bf47d89
SSDEEP 24576:V4nXubIQGyxbPV0db26rZ0ie/oflBi4ta70s4HuH0E0LyD/ncFUM39Rrs7JCpmQA:Vqe3f6HRTtBftS4eG2D/mBdA
TLSH
T1C295CF3FB2686D3ED4AA0B3245B39350597BBB61B41A8C1F17F0080EDF664711E3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4652	天问Block 编译器更新补丁-202609.tmp

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4432	tasklist.exe
5040	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2596	cmd.exe
5084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	天问Block 编译器更新补丁-202609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	天问Block 编译器更新补丁-202609.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5520-0-0x0000000000400000-0x00000000004E6000-memory.dmp	innosetup
behavioral2/memory/5520-10-0x0000000000400000-0x00000000004E6000-memory.dmp	innosetup

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	5040	tasklist.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 4652	5520	天问Block 编译器更新补丁-202609.exe	92
PID 4652 wrote to memory of 2596	4652	天问Block 编译器更新补丁-202609.tmp	93
PID 2596 wrote to memory of 4432	2596	cmd.exe	95
PID 2596 wrote to memory of 3240	2596	cmd.exe	96
PID 4652 wrote to memory of 5084	4652	天问Block 编译器更新补丁-202609.tmp	97
PID 5084 wrote to memory of 5040	5084	cmd.exe	99
PID 5084 wrote to memory of 4484	5084	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\天问Block 编译器更新补丁-202609.exe
"C:\Users\Admin\AppData\Local\Temp\天问Block 编译器更新补丁-202609.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Users\Admin\AppData\Local\Temp\is-FB1S5.tmp\天问Block 编译器更新补丁-202609.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FB1S5.tmp\天问Block 编译器更新补丁-202609.tmp" /SL5="$4019A,976986,887296,C:\Users\Admin\AppData\Local\Temp\天问Block 编译器更新补丁-202609.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "TwenBlock.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
  - - C:\Windows\SysWOW64\find.exe
      find /c /i "TwenBlock.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "天问Block.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
  - - C:\Windows\SysWOW64\find.exe
      find /c /i "天问Block.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

findSoftRes.txt

Path C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

天问Block 编译器更新补丁-202609.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FB1S5.tmp\天问Block 编译器更新补丁-202609.tmp
Size 3.1MB
SHA256 9c54942feca6b907d0568b07d9f8cf829fed6a34c2f74ac8c3e8fa0a3dcf14c7
MD5 7348a23f80782c6bbc8c2d64baf8761c
SHA1 729d704ea3ad05eb15007f326270113b4497bd99
SHA512 0d0b0d6da08f4edf0d5dc4ac34106c73e17284aff7a35cfe41f7e981010d03226a3aac58baa3c3b3b8a7c469765a812df505041e5987697552e8aeacde40a0f7
SSDEEP 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVZR63338z:692bz2Eb6pd7B6bAGx7zs333M
TLSH
T1D4E54A17F788763ED06B5A32473386D89837B66169128C27A7F8380CCF355942E3E676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4652-6-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4652-12-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4652-11-0x0000000000400000-0x0000000000720000-memory.dmp

Download

memory/5520-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/5520-10-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads