fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a

General

Target

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe
Size

314KB
MD5

2bb1eb0be2140da3d057819fd56eb848
SHA1

bd1b072b2eca138f774dd78faacfdcf4771d8b6b
SHA256

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a
SHA512

6734d7318aac2c8d52c47227dd09e4ae01905436a344e429c7575ddcfa4b3e002fd251d516111a5c4e7cc030486d8d9ac4c36760a0dc120f83d3dbfe938077f9
SSDEEP

6144:grAbUzkuvcBYC47l2xn88NEymFTYO67qzVxzRRwjC:gr1kuveY35YO67Wxz7wjC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

pid	process
1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe
1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe
1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

pid process

1324 fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe

description	pid	process	target process
PID 1324 wrote to memory of 1532	1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe	cmd.exe
PID 1324 wrote to memory of 1532	1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe	cmd.exe
PID 1324 wrote to memory of 1532	1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe	cmd.exe
PID 1324 wrote to memory of 1532	1324	fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe
"C:\Users\Admin\AppData\Local\Temp\fbf2afef028b1733cccc1fed252ef706cdc000a3bf9ee44fe0d0ac3515219c0a.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin1DE2.bat"
  2⤵
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\83FB798B\cfg\1.ini

Filesize
801B

MD5
b6a960acfc20e95fc861c7a888b38bdf

SHA1
40e164a38aafe550d36b475dafc4626cf041c1d9

SHA256
8848b50dcc1cde6a2e842aa38566f482b9ac851cbe9c139e6d836d68cc68d6e5

SHA512
6826e3a4c4a3aa7cccbef2d1152b5cf2a020418f4b5aad9bf2731b09c2d8bb780a47f3e424f569ad090fbe2e566f8f29b59b7d0d51a76bf8a90668542f4742a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin1DE2.bat

Filesize
50B

MD5
4324e25d241d6ff628a4988a63e3d5fe

SHA1
33fad980a973a292f714ac65b803fde84ab84b9e

SHA256
0c566e120298b530d5b0c2d0a4691bf0c89b9570d7af08547eecb56b147b77b7

SHA512
3b002b2c866634054881017a292c8fcb5a59e187613729ed39cda09c3e47f2ed5c0a3a31c5ce3a1e0526850ab67d5c3b4ddc8a2c15ab6965402f8e722969fdf9

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu50D4CA2A.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{6D70AEBA-4A1C-48CF-AA24-023EB6938C4C}\Custom.dll

Filesize
91KB

MD5
71ffb31fe40a3f10913982ee89fa764c

SHA1
c17fa19479a7559f666a30d2932a2b9d540bd0ee

SHA256
b0e3f473796f639cab1354971740405bc39a096839ac53b4dfaae2c4acb71599

SHA512
6913a278fa38b9cef7b317ed7eab7773447dbc786d60531455c5cb28d82c677b472f2c50b3b9e1a8a71290757f064c828721633fb5f7bef47897dc740b1567ab

Download Submit
\Users\Admin\AppData\Local\Temp\{6D70AEBA-4A1C-48CF-AA24-023EB6938C4C}\_Setup.dll

Filesize
170KB

MD5
449e327ad7b62d3a446b1d5c97c76dea

SHA1
834bfc7bef4a08ddf4dfaf0e1a1f424b66456903

SHA256
2d0f7824d781e1372ea5a931dc5aba9a76164adfbf95d0a50a785403bc0a2e2f

SHA512
f99fbd4d5e2084a91fc21a2467a447350b14a61940c30482f67c28877863693c41f9e928a39752e7fecffc8bfba609b887ddaa5bbd70e1fec18483bf1e85e986

Download Submit
memory/1324-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1532-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads