3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3

General

Target

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe
Size

314KB
MD5

0c17aeaafe69c1f82eda8e7c7e5190b0
SHA1

b7934d67ca3023ff8592d6e372c9cc60eeb6f1e8
SHA256

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3
SHA512

7edb548dd964938dd79e28a2fbe7a3374805cd6b42c72a754d297973e8eece7d7040550d14fa7cb696a0547a6304e189bf5e17893a211554743ba1b981f2e856
SSDEEP

6144:RrabUzkuvcBYC47l2x1V/GgGyjAj43W9jXdpcDfUEA1KtmTR:RrDkuveY3SV/dK4gjrcV7tY

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe
768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe
768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1316	768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe	29
PID 768 wrote to memory of 1316	768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe	29
PID 768 wrote to memory of 1316	768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe	29
PID 768 wrote to memory of 1316	768	3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe	29

C:\Users\Admin\AppData\Local\Temp\3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe
"C:\Users\Admin\AppData\Local\Temp\3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin83C4.bat"
  2⤵
  PID:1316

Network

DNS

r1.dirgreatbestepicl.info

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Remote address:

8.8.8.8:53

Request

r1.dirgreatbestepicl.info

IN A

Response
DNS

c1.applicationgrabb.com

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Remote address:

8.8.8.8:53

Request

c1.applicationgrabb.com

IN A

Response

c1.applicationgrabb.com

IN A

173.239.5.6

c1.applicationgrabb.com

IN A

173.239.8.164

c1.applicationgrabb.com

IN A

74.206.228.78
DNS

r2.dirgreatbestepicl.info

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Remote address:

8.8.8.8:53

Request

r2.dirgreatbestepicl.info

IN A

Response
GET

http://c1.applicationgrabb.com/?step_id=1&installer_id=6241077101449438628&publisher_id=2972&source_id=0&page_id=0&affiliate_id=0&country_code=DE&locale=EN&browser_id=1&download_id=1373591568904023871&external_id=0&session_id=1685523821409800192&hardware_id=3549235928381184165&installer_file_name=Doraemon&product_name=Your+File&filesize=

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

Remote address:

173.239.5.6:80

Request

GET /?step_id=1&installer_id=6241077101449438628&publisher_id=2972&source_id=0&page_id=0&affiliate_id=0&country_code=DE&locale=EN&browser_id=1&download_id=1373591568904023871&external_id=0&session_id=1685523821409800192&hardware_id=3549235928381184165&installer_file_name=Doraemon&product_name=Your+File&filesize= HTTP/1.1
Accept: */*
User-Agent: TixDll
Host: c1.applicationgrabb.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Mon, 07 Nov 2022 13:41:05 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive

173.239.5.6:80

http://c1.applicationgrabb.com/?step_id=1&installer_id=6241077101449438628&publisher_id=2972&source_id=0&page_id=0&affiliate_id=0&country_code=DE&locale=EN&browser_id=1&download_id=1373591568904023871&external_id=0&session_id=1685523821409800192&hardware_id=3549235928381184165&installer_file_name=Doraemon&product_name=Your+File&filesize=

http

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

645 B
1.3kB
5
4

HTTP Request

GET http://c1.applicationgrabb.com/?step_id=1&installer_id=6241077101449438628&publisher_id=2972&source_id=0&page_id=0&affiliate_id=0&country_code=DE&locale=EN&browser_id=1&download_id=1373591568904023871&external_id=0&session_id=1685523821409800192&hardware_id=3549235928381184165&installer_file_name=Doraemon&product_name=Your+File&filesize=

HTTP Response

200

8.8.8.8:53

r1.dirgreatbestepicl.info

dns

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

71 B
150 B
1
1

DNS Request

r1.dirgreatbestepicl.info
8.8.8.8:53

c1.applicationgrabb.com

dns

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

69 B
117 B
1
1

DNS Request

c1.applicationgrabb.com

DNS Response

173.239.5.6

173.239.8.164

74.206.228.78
8.8.8.8:53

r2.dirgreatbestepicl.info

dns

3a2a7e5f5547ee3d569debdbf7fa5ead66f21c4dfc2c4e8bf7ec87a6f77d5be3.exe

71 B
150 B
1
1

DNS Request

r2.dirgreatbestepicl.info

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\52A1E93A\cfg\1.ini

Filesize
368B

MD5
3a9830a2f57ef1e602de02bd9cc8eb56

SHA1
5135a0295755e536b833c6c6010900ff99cdbabf

SHA256
8d138bedf3228f7ef9405940526a73f49395fd2917aa22e7d5596297e222da42

SHA512
87ed85acdc1509bb02e437f50e7a90695f66b2a7a996a526f0310ba277de9ce8d7343983e2ae0b5dbedcca832bb90da802d7182972f1b14be0a203cfbd14cc41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin83C4.bat

Filesize
50B

MD5
f6adc2e448198eddf73c90d993f43233

SHA1
7e15707e140f7ae370e2c52f4ef4ad7207bb1ce6

SHA256
547c9aa4517fcd156283a1178c70042b23f68dd6da8b73488b5cdc0703354c63

SHA512
887ade5f566cf969ff70a5d6b7840bb58c53547d11f936abab2b57530d1a157b88cbdadf68dbf7f397b05708d5a130c54dd32e9af623029f7e8ebb62a4c90eb9

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu0AA4626D.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{BF37EA31-35FE-47DB-A530-7DDC64D4C8C7}\Custom.dll

Filesize
91KB

MD5
f2730fc32e76d67606196bf8322d4370

SHA1
168a3f2b9ab8c712b98ac0288ab012784d6224d4

SHA256
8148abbb512c6a95c41611d6b7618ae8eb92523310eea8a4e2ab38a513ac4e2a

SHA512
7d46f78938bfb86db07298cad39f7360c1753cfe2c5f9b8f274151bc8fe9253bb7daa0a437a8cc2101a3a90e42366e8328c61cbefdc68bc1345869e0d853f8bb

Download Submit
\Users\Admin\AppData\Local\Temp\{BF37EA31-35FE-47DB-A530-7DDC64D4C8C7}\_Setup.dll

Filesize
173KB

MD5
f726d8f3cc6b1033001ba21fbaf22655

SHA1
f0a3cb4042adb0ea429d6d000e9a66a79497d0eb

SHA256
fcb344c1a1c7eee395a023e4d9534e96c6b86c130886bf7a62e3e8ccef1e5f75

SHA512
10a6609e29d6cded049e70eb57e5941e77c5daaeb8547d3f46258f73fcc5d5f5305602212de313bf6dd15cdefb053ac09ecbb91fee75cb0dcac8ade241140270

Download Submit
memory/768-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.