f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

General

Target

Mist.Buld.exe
Size

391KB
MD5

51083ffcc13fc386b68eaa8117f48a55
SHA1

c5a7098f15174be421498cede6c8df8819e98540
SHA256

f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2
SHA512

81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

systems32.exe

pid process

1932 systems32.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
9 api.ipify.org
10 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1988 schtasks.exe
1208 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mist.Buld.exesystems32.exe

description pid process

Token: SeDebugPrivilege 2036 Mist.Buld.exe
Token: SeDebugPrivilege 1932 systems32.exe

pid	process
1932	systems32.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org
9	api.ipify.org
10	api.ipify.org

pid	process
1988	schtasks.exe
1208	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2036	Mist.Buld.exe
Token: SeDebugPrivilege	1932	systems32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Mist.Buld.exetaskeng.exesystems32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1988	2036	Mist.Buld.exe	schtasks.exe
PID 2036 wrote to memory of 1988	2036	Mist.Buld.exe	schtasks.exe
PID 2036 wrote to memory of 1988	2036	Mist.Buld.exe	schtasks.exe
PID 976 wrote to memory of 1932	976	taskeng.exe	systems32.exe
PID 976 wrote to memory of 1932	976	taskeng.exe	systems32.exe
PID 976 wrote to memory of 1932	976	taskeng.exe	systems32.exe
PID 1932 wrote to memory of 1208	1932	systems32.exe	schtasks.exe
PID 1932 wrote to memory of 1208	1932	systems32.exe	schtasks.exe
PID 1932 wrote to memory of 1208	1932	systems32.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Mist.Buld.exe
"C:\Users\Admin\AppData\Local\Temp\Mist.Buld.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe" /f
2⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {0212772E-BB6E-474F-BEF5-DD3CA039B96A} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe" /f
3⤵
- Creates scheduled task(s)
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
7f5714bb758cde36d860bb9acdbff71e

SHA1
72b56441f40a1109e94e1606a635d76578fedc38

SHA256
a6739da13d97b716163b34e076034fa9b94da61f29c7cebbcfee86b39d6a4613

SHA512
498981366d7efa496345e5629b88d0ce3697355dcbe6e380f6f6696a1da208e07854749b210c7e4f6cbc066e54f347a98e76014a47e063faeccf17f6dd6cfbb6

Download Submit
C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
MD5
51083ffcc13fc386b68eaa8117f48a55

SHA1
c5a7098f15174be421498cede6c8df8819e98540

SHA256
f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

SHA512
81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

Download Submit
C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
MD5
51083ffcc13fc386b68eaa8117f48a55

SHA1
c5a7098f15174be421498cede6c8df8819e98540

SHA256
f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

SHA512
81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

Download Submit
memory/1208-13-0x0000000000000000-mapping.dmp

Download
memory/1932-5-0x0000000000000000-mapping.dmp

Download
memory/1932-8-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-9-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1988-4-0x0000000000000000-mapping.dmp

Download
memory/2036-0-0x000007FEF6420000-0x000007FEF6E0C000-memory.dmp

Filesize
9.9MB

Download
memory/2036-1-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/2036-3-0x0000000000270000-0x0000000000305000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads