Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 23:25
Static task
static1
Behavioral task
behavioral1
Sample
Setup12.exe
Resource
win7-en-20210920
General
-
Target
Setup12.exe
-
Size
3.0MB
-
MD5
1d0e65c9adccd36e64e17ef283f272e6
-
SHA1
4f96cd93bb88aa0af573e3e7ad689f753d55a488
-
SHA256
c92233690bfbe0085091a4d3eaef1c6a3e1da06636144e88933d8c7278587227
-
SHA512
c0ee10ac49cadf02a6a534a9a28ebe79bc4e6fd9a53d0fa1fc3d80b704a3bf577bda79433d93bb5559205792d12718016203595d324b98ac9e9e93bfae383de1
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
cutm3.exeinst3.exeDownFlSetup999.exemd8_8eus.exepid process 4052 cutm3.exe 4016 inst3.exe 3044 DownFlSetup999.exe 680 md8_8eus.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md8_8eus.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ip-api.com -
Drops file in Program Files directory 12 IoCs
Processes:
Setup12.exemd8_8eus.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe Setup12.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe Setup12.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini Setup12.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst3.exe Setup12.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe Setup12.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe Setup12.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
DownFlSetup999.exemd8_8eus.exedescription pid process Token: SeDebugPrivilege 3044 DownFlSetup999.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe Token: SeManageVolumePrivilege 680 md8_8eus.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Setup12.exedescription pid process target process PID 2728 wrote to memory of 4052 2728 Setup12.exe cutm3.exe PID 2728 wrote to memory of 4052 2728 Setup12.exe cutm3.exe PID 2728 wrote to memory of 4016 2728 Setup12.exe inst3.exe PID 2728 wrote to memory of 4016 2728 Setup12.exe inst3.exe PID 2728 wrote to memory of 4016 2728 Setup12.exe inst3.exe PID 2728 wrote to memory of 3044 2728 Setup12.exe DownFlSetup999.exe PID 2728 wrote to memory of 3044 2728 Setup12.exe DownFlSetup999.exe PID 2728 wrote to memory of 680 2728 Setup12.exe md8_8eus.exe PID 2728 wrote to memory of 680 2728 Setup12.exe md8_8eus.exe PID 2728 wrote to memory of 680 2728 Setup12.exe md8_8eus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup12.exe"C:\Users\Admin\AppData\Local\Temp\Setup12.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exeMD5
17f6f3213a5a5d2fb1ef8793081c5ddd
SHA14601bd223fd7c52b12bc186ec9a0eb94167aaebb
SHA2566987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994
SHA512b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exeMD5
17f6f3213a5a5d2fb1ef8793081c5ddd
SHA14601bd223fd7c52b12bc186ec9a0eb94167aaebb
SHA2566987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994
SHA512b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\inst3.exeMD5
a41adbdafc72a86a7a74c494659954b4
SHA1d43696a0e3704a141fc0cf6a1098525c00ce882f
SHA256d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e
SHA51244a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2
-
C:\Program Files (x86)\Company\NewProduct\inst3.exeMD5
a41adbdafc72a86a7a74c494659954b4
SHA1d43696a0e3704a141fc0cf6a1098525c00ce882f
SHA256d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e
SHA51244a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
12ef159d590b06aa7673987b5b66df62
SHA10daaa15a5880766b22318e58dc7895f5c5a3f8dc
SHA256c8941c8ce0a127aa4d032eb85a3358a831ce5b2001f4664340daeba2f5b0853d
SHA512c2b6a54674c1d984b2f4cc2350e66c2edf7ec70398466f12e5ca7aae4e1497ac36f294441ea34b443e35846e3d7ee4c04300709ba539e6c9c26eb70e8cd43337
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
12ef159d590b06aa7673987b5b66df62
SHA10daaa15a5880766b22318e58dc7895f5c5a3f8dc
SHA256c8941c8ce0a127aa4d032eb85a3358a831ce5b2001f4664340daeba2f5b0853d
SHA512c2b6a54674c1d984b2f4cc2350e66c2edf7ec70398466f12e5ca7aae4e1497ac36f294441ea34b443e35846e3d7ee4c04300709ba539e6c9c26eb70e8cd43337
-
memory/680-144-0x0000000004740000-0x0000000004750000-memory.dmpFilesize
64KB
-
memory/680-147-0x00000000057E0000-0x00000000057E8000-memory.dmpFilesize
32KB
-
memory/680-126-0x0000000000000000-mapping.dmp
-
memory/680-150-0x0000000005700000-0x0000000005708000-memory.dmpFilesize
32KB
-
memory/680-149-0x0000000005700000-0x0000000005708000-memory.dmpFilesize
32KB
-
memory/680-148-0x0000000005700000-0x0000000005708000-memory.dmpFilesize
32KB
-
memory/680-146-0x0000000005700000-0x0000000005708000-memory.dmpFilesize
32KB
-
memory/680-131-0x0000000000EC0000-0x0000000000EC3000-memory.dmpFilesize
12KB
-
memory/680-145-0x0000000005700000-0x0000000005708000-memory.dmpFilesize
32KB
-
memory/680-133-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3044-132-0x000000001B830000-0x000000001B832000-memory.dmpFilesize
8KB
-
memory/3044-124-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/3044-121-0x0000000000000000-mapping.dmp
-
memory/4016-130-0x0000000001000000-0x00000000010AE000-memory.dmpFilesize
696KB
-
memory/4016-129-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/4016-118-0x0000000000000000-mapping.dmp
-
memory/4052-115-0x0000000000000000-mapping.dmp