3b949611a5b47d758f65e25acc2aa2bdc96ca925908dd6ee3dae965272e1c002

General

Target
com.ecustsdmx.signonwebsite-tphcm-net4.exe
Size 670KB
Sample261006-phyp6sys2p
SHA256 3b949611a5b47d758f65e25acc2aa2bdc96ca925908dd6ee3dae965272e1c002
MD5 942e6645d68205726a35334f4b1c8bb8
SHA1 e71414b1651f3de54953815111d4d352210188bc
SHA512 c7189f72c1a51d9e9a9f659c7bd6095bb917fa82a3423816f14af1e05fd73b9681d7a4876e2d6d4562ed34a297bbe64b0e0cf5eca674ddc5e8ac4e87de384281
SSDEEP 12288:HGqN/XdctpVtkAmDJfflLQsHJ+lDf65N3xLxZIQLceL7sLZSpbZN:hNcBtkAmDJnlLNHJwfEN3xLDZcu7s4JL
TLSH
T11DE4F102B9C188B2D1B32D3169F5A715693CBD201E20D66FE7A85D7DDB301C3A235BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	com.ecustsdmx.signonwebsite-tphcm-net4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	com.ecustsdmx.signonwebsite-tphcm-net4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2564	com.ecustsdmx.signonwebsite-tphcm-net4.exe
2564	com.ecustsdmx.signonwebsite-tphcm-net4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2820	2564	com.ecustsdmx.signonwebsite-tphcm-net4.exe	96
PID 2820 wrote to memory of 1652	2820	cmd.exe	99
PID 2820 wrote to memory of 4208	2820	cmd.exe	100
PID 2820 wrote to memory of 3908	2820	cmd.exe	101
PID 2820 wrote to memory of 4688	2820	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\com.ecustsdmx.signonwebsite-tphcm-net4.exe
"C:\Users\Admin\AppData\Local\Temp\com.ecustsdmx.signonwebsite-tphcm-net4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\com.ecustsdmx.signonwebsite\InstallExtensions.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\ljelghodcnccegncomkbfpkacbkagecf" /v update_url /t REG_SZ /d https://clients2.google.com/service/update2/crx
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\SOFTWARE\Google\Chrome\Extensions\ljelghodcnccegncomkbfpkacbkagecf" /v update_url /t REG_SZ /d https://clients2.google.com/service/update2/crx
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\ljelghodcnccegncomkbfpkacbkagecf" /v update_url /t REG_SZ /d https://clients2.google.com/service/update2/crx
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\ljelghodcnccegncomkbfpkacbkagecf" /v update_url /t REG_SZ /d https://clients2.google.com/service/update2/crx
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EcuswebAppSign.vshost.exe.config

Path C:\com.ecustsdmx.signonwebsite\EcuswebAppSign.vshost.exe.config
Size 1KB
SHA256 c8e5a9ab60d592647342a2085dbadbffe5a16aa90ae19fb0e4f1621b5669eb37
MD5 f915f3e0bb7ccb687fe3256b72cea392
SHA1 ec3b4d6e8f446de6a5f9c21b9a8cf9eb3fef5543
SHA512 61ebfd6b1477d3c2e7a25483aa5bafe174058bd56f0398a5c528441e4ba771d4fd228b4e86c0ee942e883607606707317689dea34dd052aa27152f11a4c0c316
TLSH
T13A115732AAC4A9668A604E13FE209C52EB2543151782181870EF213FDFF3C4F9B871E2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallExtensions.bat

Path C:\com.ecustsdmx.signonwebsite\InstallExtensions.bat
Size 1KB
SHA256 10b6f898595aeb94aaa637e0a65bd4e088594911d07bc5baf75aa8f584125b44
MD5 1d8b4104d1e1e713ee2f4478b70254c4
SHA1 84d6276eb3526ddbff5bf30c9230a1eb0c8cefaf
SHA512 722674fe69b23701144f349608e0c31169065d15d00c4dba77922119bbafbc8b30e4383b54eea0e7134f2d81a9d75fdf9c54b79842a1c5c1957ebf1fb29ca0ee
TLSH
T16E21CE136DE1A623965CCB10FF12210DCFE94F05B0B371A2A1CB7189818E98E35263D7
MD5 SHA1 SHA512 TLSH