49afbb1cb5c5233a0abb79e7011481b751eb3598c1a177e8beff7b5d746c9734

General

Target
49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe
Size 2.5MB
Sample220607-mt26mahfdk
SHA256 49afbb1cb5c5233a0abb79e7011481b751eb3598c1a177e8beff7b5d746c9734
MD5 2f781cdd905fea6c93a2929b02a7f4f9
SHA1 4028d40294a57afe1675c73c58e4c82b81ee2bb4
SHA512 d1b36387ceef197de8643dfea9c0e9ae825dcc52b8e1534b47947b5585874498e52bc23e198efca7b9dc6888253a2c91bab0a1e9164dc1892281d32baa45bdaf
MD5 SHA1 SHA512

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe"	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3816	2724	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe	77
PID 2724 wrote to memory of 3816	2724	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe	77
PID 2724 wrote to memory of 3816	2724	49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe	77

C:\Users\Admin\AppData\Local\Temp\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe
"C:\Users\Admin\AppData\Local\Temp\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe
  "C:\Users\Admin\AppData\Local\Temp\49AFBB1CB5C5233A0ABB79E7011481B751EB3598C1A177E8BEFF7B5D746C9734.exe" dog 393282
  2⤵
  PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DreamApslop.dll

Path C:\Users\Admin\AppData\Local\Temp\plugin\DreamApslop.dll
Size 2.6MB
SHA256 22696773e65fbbf4d348f9190ff318bdf1b6dbfc4726033b5e35b2436bb5a9cc
MD5 0ce3a923f6263d877946ffbeb4666de7
SHA1 a84f4f2bfd4351c5b05e9d6017bddd9572574a0d
SHA512 3631ec39297b8647afe7c98dc26ef5d16445a6703a5b302fbbe60c79f962c10a2687b0c91a5f6f02e5524ff4ef7519fa646fe96655db721f54b5945c50c038be
SSDEEP 49152:NsHFg3hRNAoDDvx1JryPsWw5YzC/7a5LIi4ngo9WKmNM:NsHFUoIWw5v/AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing