d8ba690a888d144be39d35edbb8c1b0b.exe

General
Target

d8ba690a888d144be39d35edbb8c1b0b.exe

Filesize

402KB

Completed

30-10-2021 09:20

Score
10/10
MD5

d8ba690a888d144be39d35edbb8c1b0b

SHA1

236d096f35b8fb375f0604b723016e34d3ed186f

SHA256

fdadaa29cddfdc73c668258fea6614be64a933dcfa19072a6342024985a0a68b

Malware Config
Signatures 13

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Downloads MZ/PE file
  • Executes dropped EXE
    4v_TRgEN3vm6BOS7OCZ93AQL.exe

    Reported IOCs

    pidprocess
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
  • Checks computer location settings
    d8ba690a888d144be39d35edbb8c1b0b.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nationd8ba690a888d144be39d35edbb8c1b0b.exe
  • Loads dropped DLL
    d8ba690a888d144be39d35edbb8c1b0b.exe

    Reported IOCs

    pidprocess
    1680d8ba690a888d144be39d35edbb8c1b0b.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    15ipinfo.io
    14ipinfo.io
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    12721680WerFault.exed8ba690a888d144be39d35edbb8c1b0b.exe
  • Suspicious behavior: EnumeratesProcesses
    d8ba690a888d144be39d35edbb8c1b0b.exe4v_TRgEN3vm6BOS7OCZ93AQL.exeWerFault.exe

    Reported IOCs

    pidprocess
    1680d8ba690a888d144be39d35edbb8c1b0b.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    1272WerFault.exe
    1272WerFault.exe
    1272WerFault.exe
    1272WerFault.exe
    1272WerFault.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
    12964v_TRgEN3vm6BOS7OCZ93AQL.exe
  • Suspicious behavior: GetForegroundWindowSpam
    WerFault.exe

    Reported IOCs

    pidprocess
    1272WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1272WerFault.exe
  • Suspicious use of WriteProcessMemory
    d8ba690a888d144be39d35edbb8c1b0b.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1680 wrote to memory of 12961680d8ba690a888d144be39d35edbb8c1b0b.exe4v_TRgEN3vm6BOS7OCZ93AQL.exe
    PID 1680 wrote to memory of 12961680d8ba690a888d144be39d35edbb8c1b0b.exe4v_TRgEN3vm6BOS7OCZ93AQL.exe
    PID 1680 wrote to memory of 12961680d8ba690a888d144be39d35edbb8c1b0b.exe4v_TRgEN3vm6BOS7OCZ93AQL.exe
    PID 1680 wrote to memory of 12961680d8ba690a888d144be39d35edbb8c1b0b.exe4v_TRgEN3vm6BOS7OCZ93AQL.exe
    PID 1680 wrote to memory of 12721680d8ba690a888d144be39d35edbb8c1b0b.exeWerFault.exe
    PID 1680 wrote to memory of 12721680d8ba690a888d144be39d35edbb8c1b0b.exeWerFault.exe
    PID 1680 wrote to memory of 12721680d8ba690a888d144be39d35edbb8c1b0b.exeWerFault.exe
    PID 1680 wrote to memory of 12721680d8ba690a888d144be39d35edbb8c1b0b.exeWerFault.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\d8ba690a888d144be39d35edbb8c1b0b.exe
    "C:\Users\Admin\AppData\Local\Temp\d8ba690a888d144be39d35edbb8c1b0b.exe"
    Checks computer location settings
    Loads dropped DLL
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\Pictures\Adobe Films\4v_TRgEN3vm6BOS7OCZ93AQL.exe
      "C:\Users\Admin\Pictures\Adobe Films\4v_TRgEN3vm6BOS7OCZ93AQL.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1412
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1272
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Pictures\Adobe Films\4v_TRgEN3vm6BOS7OCZ93AQL.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • \Users\Admin\Pictures\Adobe Films\4v_TRgEN3vm6BOS7OCZ93AQL.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • memory/1272-60-0x00000000007B0000-0x0000000000818000-memory.dmp

                • memory/1272-59-0x0000000000000000-mapping.dmp

                • memory/1296-57-0x0000000000000000-mapping.dmp

                • memory/1680-55-0x0000000003AE0000-0x0000000003C2A000-memory.dmp

                • memory/1680-54-0x0000000076851000-0x0000000076853000-memory.dmp