2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172

General

Target

2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe
Size

6.3MB
MD5

53782906aa3c7de6b164349a5cad123f
SHA1

8bb213d8d34a944b2103a5bba387da52c8c1d926
SHA256

2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172
SHA512

3e736093ddca8fe283bc4dce95d6383e8f25248664f4815b2b3bf1916f6531bdb508303014e1ceea109a93ae08275d8c4c1ff5dbb4e9771d63cd3a1640eab741

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

FiddlerSetup.exe

pid process

1136 FiddlerSetup.exe
Loads dropped DLL 1 IoCs

Processes:

2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe

pid process

2036 2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1136	FiddlerSetup.exe

pid	process
2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe

description	pid	process	target process
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe
PID 2036 wrote to memory of 1136	2036	2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe	FiddlerSetup.exe

C:\Users\Admin\AppData\Local\Temp\2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe
"C:\Users\Admin\AppData\Local\Temp\2afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe" /D=
2⤵
- Executes dropped EXE
PID:1136

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe
Filesize
3.1MB

MD5
155b1deb7ed05cfe46d415abc04daeb6

SHA1
c6218cfc31c96a01c016d69dcb310a05b58e7af7

SHA256
e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c

SHA512
9214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe
Filesize
3.1MB

MD5
155b1deb7ed05cfe46d415abc04daeb6

SHA1
c6218cfc31c96a01c016d69dcb310a05b58e7af7

SHA256
e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c

SHA512
9214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b

Download Submit
\Users\Admin\AppData\Local\Temp\nsiD6C1.tmp\FiddlerSetup.exe
Filesize
3.1MB

MD5
155b1deb7ed05cfe46d415abc04daeb6

SHA1
c6218cfc31c96a01c016d69dcb310a05b58e7af7

SHA256
e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c

SHA512
9214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b

Download Submit
memory/1136-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing