6e3816fe96ae72f3c7695e1a64225ed36ff8a7e61f0fb192447cb14d5736dcea

General

Target

00909000870.exe
Size

1.1MB
MD5

b6d292139cbd769bfa7c005cbc3a8202
SHA1

f12d48f3aa3a1910795a12fbc57b32d24145af73
SHA256

6e3816fe96ae72f3c7695e1a64225ed36ff8a7e61f0fb192447cb14d5736dcea
SHA512

3cde67951d45796bf76c7724db52cc2bf64d40cf55e5bb751c98a0028ea309549f0344f1c0e1adf32c384441a02507cbfbaf0476761bebc37f5816079472dc6a

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

00909000870.exe

pid process

788 00909000870.exe

pid	process
788	00909000870.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

00909000870.exe00909000870.exe

description	pid	process	target process
PID 788 set thread context of 2044	788	00909000870.exe	00909000870.exe
PID 2044 set thread context of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 set thread context of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 set thread context of 620	2044	00909000870.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

00909000870.exe

pid process

2044 00909000870.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

00909000870.exe

pid process

788 00909000870.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

00909000870.exe

pid process

2044 00909000870.exe
2044 00909000870.exe

pid	process
2044	00909000870.exe

pid	process
788	00909000870.exe

pid	process
2044	00909000870.exe
2044	00909000870.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

00909000870.exe00909000870.exe

description	pid	process	target process
PID 788 wrote to memory of 2044	788	00909000870.exe	00909000870.exe
PID 788 wrote to memory of 2044	788	00909000870.exe	00909000870.exe
PID 788 wrote to memory of 2044	788	00909000870.exe	00909000870.exe
PID 788 wrote to memory of 2044	788	00909000870.exe	00909000870.exe
PID 788 wrote to memory of 2044	788	00909000870.exe	00909000870.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1836	2044	00909000870.exe	AppLaunch.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 1360	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe
PID 2044 wrote to memory of 620	2044	00909000870.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\00909000870.exe
"C:\Users\Admin\AppData\Local\Temp\00909000870.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\00909000870.exe
"C:\Users\Admin\AppData\Local\Temp\00909000870.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
PID:620

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsn224.tmp\b7lqb2393a.dll
MD5
93fbd7c82ab517898fb113578a37530a

SHA1
966c0aedf19881ac23eb4b1058584e51366fb542

SHA256
57d4bac2f5f89cf338ee2d7b4cf7781aa55a9497fccaba58b86682bf9f884ec1

SHA512
3ca35c59b214f9a3fbd00d497113b94049e738352b499323564eb31712ad7cb2af4ae5fc8344d5c90ee21c862b779eaeeceaa618aee3bfe78b3f8f2f86839023

Download Submit
memory/620-77-0x0000000000404212-mapping.dmp

Download
memory/620-78-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-60-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/788-66-0x0000000002720000-0x000000000336A000-memory.dmp

Filesize
12.3MB

Download
memory/788-67-0x0000000002720000-0x000000000336A000-memory.dmp

Filesize
12.3MB

Download
memory/1360-71-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1360-72-0x0000000000404212-mapping.dmp

Download
memory/1360-73-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1836-70-0x00000000004A734E-mapping.dmp

Download
memory/2044-62-0x00000000004025C4-mapping.dmp

Download
memory/2044-68-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

Analysis

Sharing