a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405

General

Target
a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe
Size 111.9MB
Sample261016-jbk8lsbs8t
SHA256 a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405
MD5 41c6455273a28d6294052a3db575f2ea
SHA1 9d096b140e38a6d880e0960725e4abbd47ea4582
SHA512 d9ea61522dc342a74bf79afe648b655f8e1f661e46bcde4c62846c3bd99c160010c14759968f86140f627b93b45bba23175515fdead17740a3da4f8ea3f5c94f
SSDEEP 1572864:1Pp36F/iKRzko0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZh:1PpIlkheuXpX/z/5NivOcC7hlTrv
TLSH
T16F48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6132	powershell.exe
3920	powershell.exe
3920	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	zl5hrEGUZGur.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	zl5hrEGUZGur.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2720	cmd.exe
3292	cmd.exe
3328	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6132	powershell.exe
6132	powershell.exe
3920	powershell.exe
3920	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6132	powershell.exe
Token: SeDebugPrivilege	3920	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2720	4532	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	84
PID 2720 wrote to memory of 6132	2720	cmd.exe	86
PID 4532 wrote to memory of 3292	4532	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	96
PID 3292 wrote to memory of 712	3292	cmd.exe	98
PID 712 wrote to memory of 2404	712	net.exe	99
PID 4532 wrote to memory of 3328	4532	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	100
PID 3328 wrote to memory of 3920	3328	cmd.exe	102
PID 3920 wrote to memory of 6004	3920	powershell.exe	105
PID 4532 wrote to memory of 2804	4532	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	107

C:\Users\Admin\AppData\Local\Temp\a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe
"C:\Users\Admin\AppData\Local\Temp\a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:6004
- C:\ProgramData\zl5hrEGUZGur.exe
  C:\ProgramData\zl5hrEGUZGur.exe
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zl5hrEGUZGur.exe

Path C:\ProgramData\zl5hrEGUZGur.exe
Size 809KB
SHA256 c62c4ef6244f7e552813c8b7e3c47dbc758fa2fcbad8c0d07225f444697e420f
MD5 76cb00a1eff64dc2b0b1e061b0aa109e
SHA1 ba967d8bc78b93513e12d0a72fb126142ebdf105
SHA512 7ba204ed24943efa9fcd603636883f5455caa23c9ec5943ade8a9b3a752d1fcd16ddf35544b17d06f17934d96ff6e9760706cfa2293410e15f85a5f0152e83a8
SSDEEP 6144:XmK/bwx6NI08VGSh1cjqrsr5y2JUQjWqX4C46I84eR+ZtBQ0QX3jUzgyOKbySeR4:XmibwM8VbQqrN9dWBaOmQ
TLSH
T1540574B2A312B541E843D37ABD1F2B575A7E3DC60224EA322099CF5134E29734579B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8d0896f043e62ea4952833cb20d23fc5f39f2a004bada23c71fc41af8b37a6e2
MD5 4b6a25c71368c32af07089d65cb075f5
SHA1 489f98f82b860b96b375af8b236d2a390c6e2fd4
SHA512 24f6478e8bc175d10bd849356a35b421daf718839c344ce1a14ac0324d4c90162df618f690de61d992a92fc4c9b8cf8bb46eddb8560da5a126ad0904456ef4c9
TLSH
T10F51DF313376B0D888163F461D691AC053BF4355FA94AF1CB698625EDE2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a255f30324dd5fd39da1e4e28152e42efe76865828d9ed5cfa1931548d9b3302
MD5 718df9dd0403039267e30ce0807dbf40
SHA1 7935cb862564dc08f201ad13dd9d4fddfaa4be50
SHA512 34c82634c91089f1010c09aa014a647de0ba5bc5a7c3e6293b753eaece0745862ade6fc44507d5e55f898ac6894c1087e8d4a7f5347f7679addd11af1bebf3e9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1i243tnv.vrf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1i243tnv.vrf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6132-1-0x00000254C0CD0000-0x00000254C0CE0000-memory.dmp

Download

memory/6132-2-0x00000254C0CD0000-0x00000254C0CE0000-memory.dmp

Download

memory/6132-8-0x00000254C1630000-0x00000254C1652000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads