900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1

General

Target
900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
Size 624KB
Sample261011-pd732sty4p
SHA256 900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1
MD5 b51505df06c78bf5d601db0e75030455
SHA1 130242f02c3ccc4293cd7d67737282d7a735f438
SHA512 662b14703ea99b238aa5b23d8eeedef1c12818639cb9b77b136105cb8736ceb6af0ef4fae4fed5378cdd907fa09e14ce24c916c87cdd1b8ea171c4faa5f08e2e
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+p:An4bgVhNrAM1qgg2jfO
TLSH
T1C7D47B1153E60116F1B79B3178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
532	ineci.exe

Executes dropped EXE 1 IoCs

pid	Process
532	ineci.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ineci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4184	cmd.exe
1836	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1836	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5036	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
532	ineci.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4184	5036	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe	88
PID 4184 wrote to memory of 1836	4184	cmd.exe	90
PID 4184 wrote to memory of 532	4184	cmd.exe	94
PID 532 wrote to memory of 2392	532	ineci.exe	95

C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
"C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\ineci.exe "C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\ineci.exe
    C:\Users\Admin\AppData\Local\Temp\\ineci.exe "C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\ufltbzb\mhwvkc.hvm",RAFlush C:\Users\Admin\AppData\Local\Temp\ineci.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ineci.exe

Path C:\Users\Admin\AppData\Local\Temp\ineci.exe
Size 624KB
SHA256 bcdbfbc292af597c979f29539f3a43d171c2879788dac2456c36293c2052d9dc
MD5 88a8a9ed761c3705c2d1056ba3fe5f15
SHA1 8dc193343ffe4c1cc0253440af42aa644c91b2c3
SHA512 5f85e1d9e58033cea0d0ce194bf5f1e9e609103101f115159b0726dab97dbdc031ed13e35863fd852e591055629e1f62b5f27f31655a38065988e68fec2c1e02
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+i:An4bgVhNrAM1qgg2jfO/
TLSH
T184D47B1153E60116F1B79B3178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhwvkc.hvm

Path \??\c:\ufltbzb\mhwvkc.hvm
Size 155KB
SHA256 42097ad9ae64e2ff7ed139fef0a7eb53c57a37c9215ebc275411841e198c3e02
MD5 a8c9fc170d8d954a4c27141f56db38f3
SHA1 3e9bd10e353469f8e540de675a63fed8cc70bdb7
SHA512 5793c869c862bb77d92a9045ed5a951bd57837b7d631c7ea03a1764f7f0c6ceae68bbfb1f6f7f3143829d5b53f5973d3f1f3e6afc47bd3822251f0beb5c37f9c
SSDEEP 3072:zqVT34l0v8ljGh11D/cWiREpUDC4Li/F+fF9CTJ/AZMlDfogExfE:zQu0vsah3D/cWiWp9TdlDwgExc
TLSH
T15EF3E7534BC66719886805FCA8E28D9781848BD089BC3FFAC07194FF9C95926E4EF7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-8-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/5036-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/5036-2-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads