Sun038aa349e3318e.exe

General
Target

Sun038aa349e3318e.exe

Filesize

172KB

Completed

31-10-2021 20:24

Score
10/10
MD5

24766cc32519b05db878cf9108faeec4

SHA1

c553780cb609ec91212bcdd25d25dde9c8ef5016

SHA256

d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530

Malware Config
Signatures 12

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Downloads MZ/PE file
  • Executes dropped EXE
    w1uJaP0__PMtpZNJ14iuLOHB.exe

    Reported IOCs

    pidprocess
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
  • Checks computer location settings
    Sun038aa349e3318e.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\NationSun038aa349e3318e.exe
  • Loads dropped DLL
    Sun038aa349e3318e.exe

    Reported IOCs

    pidprocess
    1120Sun038aa349e3318e.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    14ipinfo.io
    15ipinfo.io
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    20321120WerFault.exeSun038aa349e3318e.exe
  • Suspicious behavior: EnumeratesProcesses
    Sun038aa349e3318e.exew1uJaP0__PMtpZNJ14iuLOHB.exeWerFault.exe

    Reported IOCs

    pidprocess
    1120Sun038aa349e3318e.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    2032WerFault.exe
    2032WerFault.exe
    2032WerFault.exe
    2032WerFault.exe
    2032WerFault.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
    288w1uJaP0__PMtpZNJ14iuLOHB.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2032WerFault.exe
  • Suspicious use of WriteProcessMemory
    Sun038aa349e3318e.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1120 wrote to memory of 2881120Sun038aa349e3318e.exew1uJaP0__PMtpZNJ14iuLOHB.exe
    PID 1120 wrote to memory of 2881120Sun038aa349e3318e.exew1uJaP0__PMtpZNJ14iuLOHB.exe
    PID 1120 wrote to memory of 2881120Sun038aa349e3318e.exew1uJaP0__PMtpZNJ14iuLOHB.exe
    PID 1120 wrote to memory of 2881120Sun038aa349e3318e.exew1uJaP0__PMtpZNJ14iuLOHB.exe
    PID 1120 wrote to memory of 20321120Sun038aa349e3318e.exeWerFault.exe
    PID 1120 wrote to memory of 20321120Sun038aa349e3318e.exeWerFault.exe
    PID 1120 wrote to memory of 20321120Sun038aa349e3318e.exeWerFault.exe
    PID 1120 wrote to memory of 20321120Sun038aa349e3318e.exeWerFault.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\Sun038aa349e3318e.exe
    "C:\Users\Admin\AppData\Local\Temp\Sun038aa349e3318e.exe"
    Checks computer location settings
    Loads dropped DLL
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\Pictures\Adobe Films\w1uJaP0__PMtpZNJ14iuLOHB.exe
      "C:\Users\Admin\Pictures\Adobe Films\w1uJaP0__PMtpZNJ14iuLOHB.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:288
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1396
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2032
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Pictures\Adobe Films\w1uJaP0__PMtpZNJ14iuLOHB.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • \Users\Admin\Pictures\Adobe Films\w1uJaP0__PMtpZNJ14iuLOHB.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • memory/288-56-0x0000000000000000-mapping.dmp

                • memory/1120-53-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

                • memory/1120-54-0x0000000003BE0000-0x0000000003D2A000-memory.dmp

                • memory/2032-58-0x0000000000000000-mapping.dmp

                • memory/2032-59-0x00000000002C0000-0x00000000002C1000-memory.dmp