3a9e76c0a3bb32bacef69ff86e7d3cb9c9d5c7c65a8100e07428871da1577652

General

Target
4829c4ab4e71d8bbb97fcf5b91f1963b.exe
Size 255KB
Sample220128-knqvasaaem
SHA256 3a9e76c0a3bb32bacef69ff86e7d3cb9c9d5c7c65a8100e07428871da1577652
MD5 4829c4ab4e71d8bbb97fcf5b91f1963b
SHA1 6de31b1d4e413f85fd4a1b2f4eb034827f888de3
SHA512 d720c6d33f75e55a8fb50d332bfd24bfe260d3f973d24fc3d82ce1e25dcdeb49224915014c4f3cea07b54a947b9b5df233700c3fbfce12f2056e2a851e54a7e3
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
648	fdlaunchersa.exe
1224	fdlaunchersa.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000125ca-62.dat	upx
behavioral1/files/0x00070000000125ca-65.dat	upx
behavioral1/files/0x00070000000125ca-64.dat	upx
behavioral1/files/0x00070000000125ca-66.dat	upx
behavioral1/files/0x00070000000125ca-69.dat	upx
behavioral1/files/0x00070000000125ca-71.dat	upx

Deletes itself 1 IoCs

pid	Process
288	WScript.exe

Loads dropped DLL 3 IoCs

pid	Process
648	fdlaunchersa.exe
648	fdlaunchersa.exe
1224	fdlaunchersa.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 648 set thread context of 1224	648	fdlaunchersa.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe	4829c4ab4e71d8bbb97fcf5b91f1963b.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe	4829c4ab4e71d8bbb97fcf5b91f1963b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 1524 wrote to memory of 868	1524	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	27
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 648 wrote to memory of 1224	648	fdlaunchersa.exe	29
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30
PID 868 wrote to memory of 288	868	4829c4ab4e71d8bbb97fcf5b91f1963b.exe	30

C:\Users\Admin\AppData\Local\Temp\4829c4ab4e71d8bbb97fcf5b91f1963b.exe
"C:\Users\Admin\AppData\Local\Temp\4829c4ab4e71d8bbb97fcf5b91f1963b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\4829c4ab4e71d8bbb97fcf5b91f1963b.exe
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\3105.vbs"
    3⤵
    - Deletes itself
    PID:288

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-61-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/868-60-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/868-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/868-57-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/868-56-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1524-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads