116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7

General

Target

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Size

31KB
MD5

05040dfe39ea468ef525df6c52c58e80
SHA1

f5dc32557c5c45e6bd66fb18d57e164f968908dc
SHA256

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7
SHA512

2c8d1db55689eb0e63dcc6c9d4e75df26644607bb5029d123afdbfb48ec1d34cc21ad40fcd43a52540fbff033f5e5037ea328a7025dff981ebd0880e4152b362
SSDEEP

768:tqku0P5K8KZLnR3JQCxNiwDaVQr1rDnpIOw3VzaM9o:tqku0P5zqTzrx0wGVQr1/Pwlz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1464 cmd.exe

pid	process
1464	cmd.exe

Drops file in System32 directory 5 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sxload.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File created	C:\Windows\System32\123F5B6.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File opened for modification	C:\Windows\SysWOW64\123F5B6.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File created	C:\Windows\System32\123F902.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File opened for modification	C:\Windows\SysWOW64\123F902.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

Drops file in Program Files directory 1 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxlzg.tmp 116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1328 taskkill.exe
1268 taskkill.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxlzg.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

pid	process
1328	taskkill.exe
1268	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

pid	process
1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

description	pid	process	target process
PID 1632 wrote to memory of 1328	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1328	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1328	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1328	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1268	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1268	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1268	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1268	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 1632 wrote to memory of 1464	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 1632 wrote to memory of 1464	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 1632 wrote to memory of 1464	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 1632 wrote to memory of 1464	1632	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
"C:\Users\Admin\AppData\Local\Temp\116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "DragonNest.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "sdologin.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 1.bat
  2⤵
  - Deletes itself
  PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
251B

MD5
195e41626b00cdde54fc9b9eb8f02e49

SHA1
ea99a6ea3a1ddf5e3519fb7f020351462d26121a

SHA256
b555da6bfba1be58b55b8a2ee413f27a51b829bae7efbe43ab06b3322fc00e72

SHA512
1acdce028dc6a5f8eecfd4925992b18b7a5080f54480160b153c48fe5633c440db3f44e23813b7786c40072556110189f2550940f4d2ec35bd917254e7092f91

Download Submit
memory/1268-57-0x0000000000000000-mapping.dmp

Download
memory/1328-56-0x0000000000000000-mapping.dmp

Download
memory/1464-58-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x0000000074651000-0x0000000074653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads