d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2

General

Target

d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe
Size

7.7MB
MD5

fd9f596b0d88024cffa94540cb837e6b
SHA1

85704c78d3726ac45ff0fc9b6504873a56a8094c
SHA256

d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2
SHA512

47154c927ea66deef12e4f4ebbfa11e115afd9a484b2015a64f018ca9a1568b5de1692a1315b492d4f79b8721a7dfa2728a2c10a3717d6dce550e0761928b7e5
SSDEEP

196608:d/p7W7CxzD/64edSppgTeFCa28Ry4SaZywpBwO3+76sdZGat4r:dx7Yw3/iSpeU3ZRjJyw7wI+71rGat4r

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

HOST.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\__tmp_rar_sfx_access_check_240561640	HOST.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	HOST.exe

Executes dropped EXE 2 IoCs

Processes:

HOST.exeIDM.exe

pid process

3000 HOST.exe
4084 IDM.exe

pid	process
3000	HOST.exe
4084	IDM.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IDM.exed22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	IDM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe

Drops file in Program Files directory 64 IoCs

Processes:

IDM.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_pl.txt	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\idmwfp.inf	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\GS.L.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\idm_fa.lng	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_ptbr.lng	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Skin2\3d_largeHot_3.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Large_Normal.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\idmwfp32.sys	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Bronze_Shapes_Toolbar\H3M_BS_Small_Normal.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\NG_smallHot.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Primo_hot.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll~~	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\ThL-Toolbar_bmps\ThL-Normal.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\luckyToolbar2.tbi	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\tips.txt	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\tips_tr.txt	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\idmtdi.cat	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_style_3.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Buttons_Toolbar	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Olive_Shapes_Toolbar	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Bils_Style.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\NG.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\tips_ptbr.txt	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\idmwfp.inf	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\inst_kr.lng	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\Dtu_Style-Large_Disabled.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Mosi_Modern_XP.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\IEGetVL2.htm	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_ptbr.lng	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Skin2	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Globe.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\template.lng	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\DK\dk_largeHot_3.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Koushik_Halder_Large_Normal.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Koushik Halder.tbi	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\IDMFType64.dll	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Buttons_Toolbar\H3M_Buttons_Small_Hot.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\NG_smallHot.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Bils_Style\bils_style-Large_Disabled.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\GS.L\GS.L3d_large_3.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Olive_Shapes_Toolbar\H3M_OS_Large_Hot.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013.tbi	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_ar.lng	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\luckyToolbar2.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Bils_Style.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\idm_nl.lng	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Disable.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\Dtu_Style-Large_Normal.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Bils_Style\bils_style-Small_Hot.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Glossy_Toolbar\H3M_Glossy_Small_Normal.bmp	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\idmtdi32.sys	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_smallHot_3.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\idmmzcc.xpi	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Glossy_Toolbar\H3M_Glossy_Small_Hot.bmp	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\Blue_Arrow.tbi	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\idmfsa.dll	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\Languages\idm_ptbr.lng	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Glossy.tbi	IDM.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\scheduler.chm	IDM.exe
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_th.lng	IDM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

4028 regedit.exe

pid	process
4028	regedit.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exeIDM.exe

description	pid	process	target process
PID 3392 wrote to memory of 3000	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	HOST.exe
PID 3392 wrote to memory of 3000	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	HOST.exe
PID 3392 wrote to memory of 3000	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	HOST.exe
PID 3392 wrote to memory of 4084	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	IDM.exe
PID 3392 wrote to memory of 4084	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	IDM.exe
PID 3392 wrote to memory of 4084	3392	d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe	IDM.exe
PID 4084 wrote to memory of 4028	4084	IDM.exe	regedit.exe
PID 4084 wrote to memory of 4028	4084	IDM.exe	regedit.exe
PID 4084 wrote to memory of 4028	4084	IDM.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe
"C:\Users\Admin\AppData\Local\Temp\d22d57bcf039041fd0b1f0792293fae6d47f24919b147abc5ba6351a0eb6a5c2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3392

C:\Users\Admin\AppData\Local\Temp\RarSFX0\HOST.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\HOST.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3000

C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /S reg.reg
3⤵
- Runs .reg file with regedit
PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Download Manager\REG.reg

Filesize
1KB

MD5
b5a4d7472c0cea64a0b2f02a4c15aa5b

SHA1
2a1b37222568bf0571ff23248497cab0ff1b66bf

SHA256
570d4af82f9892fcc84c9205d38da0713a596f9fcaf944a65494ac47bdfd98f4

SHA512
c048c6196ea2eef0cc60f4472b71ecc7dc5f9813168c8bbfd8d5fdd013d8ad543fc802c793ba462985505d4c5b89a2cd473724cf9d4cf873a8391f0f5d90d8c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\HOST.exe

Filesize
97KB

MD5
4cf55abdd357a8284a5a8a4e9238541d

SHA1
7aaa62953f24552b1427973d72f4220715004626

SHA256
449bad57a49cbb06d13723fd534df9223490b3c76a62fda4052d778e3335c970

SHA512
aaf7041d9ed9287060db7c77782e580cfb8aca5c9495c638a3128971cadf786d1b93fe0ae0f6ddde4431d6f171e9051992fa05af6091e83cdf627c91909f4978

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\HOST.exe

Filesize
97KB

MD5
4cf55abdd357a8284a5a8a4e9238541d

SHA1
7aaa62953f24552b1427973d72f4220715004626

SHA256
449bad57a49cbb06d13723fd534df9223490b3c76a62fda4052d778e3335c970

SHA512
aaf7041d9ed9287060db7c77782e580cfb8aca5c9495c638a3128971cadf786d1b93fe0ae0f6ddde4431d6f171e9051992fa05af6091e83cdf627c91909f4978

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM.exe

Filesize
7.4MB

MD5
0ccbff0f52ecfeee22366fa7c19e7cfb

SHA1
124f5094947e1877fc6cb7a5ffe6c750a0109061

SHA256
3f5564bc8e7aad593eccbdc9c4cbaf52f9c36e40c496586067f32c304c179c15

SHA512
7c507b6faa53fd835be2fc8d315366810b7528fd1216b1342c5358047cf49bb4a71d8520974777e655a35579af28fee2fb5e86772d033078c78af8b0d2fa3f46

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM.exe

Filesize
7.4MB

MD5
0ccbff0f52ecfeee22366fa7c19e7cfb

SHA1
124f5094947e1877fc6cb7a5ffe6c750a0109061

SHA256
3f5564bc8e7aad593eccbdc9c4cbaf52f9c36e40c496586067f32c304c179c15

SHA512
7c507b6faa53fd835be2fc8d315366810b7528fd1216b1342c5358047cf49bb4a71d8520974777e655a35579af28fee2fb5e86772d033078c78af8b0d2fa3f46

Download Submit
memory/3000-132-0x0000000000000000-mapping.dmp

Download
memory/4028-138-0x0000000000000000-mapping.dmp

Download
memory/4084-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads