f3fada003d43df7ab5b4f7d41a1b90646797bb41ecb4ca1c3afb37baaba10264

General

Target
FBDC41A2C1059FC99B592EF844EE9311.exe
Size 1.2MB
Sample210408-k4mdclvjvx
SHA256 f3fada003d43df7ab5b4f7d41a1b90646797bb41ecb4ca1c3afb37baaba10264
MD5 fbdc41a2c1059fc99b592ef844ee9311
SHA1 80c76bd783ef25062ac252f1b4422bc5f9dff909
SHA512 31045aeb3614a5c2ea59512c7e025cc48aca679da74e0faadfd43f9b6ad114e07e25210a7544443a57ecab60c0dc6a4d579fd51a872c55551cb508fec49030a3
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	a.exe

Loads dropped DLL 1 IoCs

pid	Process
432	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
484	FBDC41A2C1059FC99B592EF844EE9311.exe
484	FBDC41A2C1059FC99B592EF844EE9311.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe
1476	a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
568	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
528	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
484	FBDC41A2C1059FC99B592EF844EE9311.exe
484	FBDC41A2C1059FC99B592EF844EE9311.exe
484	FBDC41A2C1059FC99B592EF844EE9311.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	484	FBDC41A2C1059FC99B592EF844EE9311.exe
Token: SeDebugPrivilege	1476	a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
484	FBDC41A2C1059FC99B592EF844EE9311.exe
1476	a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1744	484	FBDC41A2C1059FC99B592EF844EE9311.exe	29
PID 484 wrote to memory of 1744	484	FBDC41A2C1059FC99B592EF844EE9311.exe	29
PID 484 wrote to memory of 1744	484	FBDC41A2C1059FC99B592EF844EE9311.exe	29
PID 484 wrote to memory of 1744	484	FBDC41A2C1059FC99B592EF844EE9311.exe	29
PID 484 wrote to memory of 432	484	FBDC41A2C1059FC99B592EF844EE9311.exe	31
PID 484 wrote to memory of 432	484	FBDC41A2C1059FC99B592EF844EE9311.exe	31
PID 484 wrote to memory of 432	484	FBDC41A2C1059FC99B592EF844EE9311.exe	31
PID 484 wrote to memory of 432	484	FBDC41A2C1059FC99B592EF844EE9311.exe	31
PID 1744 wrote to memory of 568	1744	cmd.exe	33
PID 1744 wrote to memory of 568	1744	cmd.exe	33
PID 1744 wrote to memory of 568	1744	cmd.exe	33
PID 1744 wrote to memory of 568	1744	cmd.exe	33
PID 432 wrote to memory of 528	432	cmd.exe	34
PID 432 wrote to memory of 528	432	cmd.exe	34
PID 432 wrote to memory of 528	432	cmd.exe	34
PID 432 wrote to memory of 528	432	cmd.exe	34
PID 432 wrote to memory of 1476	432	cmd.exe	35
PID 432 wrote to memory of 1476	432	cmd.exe	35
PID 432 wrote to memory of 1476	432	cmd.exe	35
PID 432 wrote to memory of 1476	432	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\FBDC41A2C1059FC99B592EF844EE9311.exe
"C:\Users\Admin\AppData\Local\Temp\FBDC41A2C1059FC99B592EF844EE9311.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "a" /tr '"C:\Users\Admin\AppData\Roaming\a.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "a" /tr '"C:\Users\Admin\AppData\Roaming\a.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4144.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:528
- - C:\Users\Admin\AppData\Roaming\a.exe
    "C:\Users\Admin\AppData\Roaming\a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-60-0x0000000000930000-0x0000000000932000-memory.dmp

Download

memory/484-61-0x0000000000930000-0x0000000000932000-memory.dmp

Download

memory/484-63-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/484-59-0x0000000075E51000-0x0000000075E53000-memory.dmp

Download

memory/1476-74-0x0000000001090000-0x0000000001092000-memory.dmp

Download

memory/1476-75-0x0000000001090000-0x0000000001092000-memory.dmp

Download

memory/1476-77-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads