b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885

General

Target

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
Size

881KB
MD5

6af496f3bbdba25ce16e8ba856feb716
SHA1

459e6c3a7e8a3a6676c3282ce640658a3340e927
SHA256

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885
SHA512

e93fb232fd5d87840d19fe13904b8b9bd708d543cf50f0a2eecf4aa2cd99f50b338e059efd4a32de540d64438c16b57f32d0c516ca676745bbdf1c6d8ac54627
SSDEEP

24576:mQMSdDaw0gZEJs2QC/TwYBoGrHBYD9nceNaxhP6tM:m6T0gZEJJQgwghFYZhaqS

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1132 svchost.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation svchost.exe

pid	process
1132	svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	svchost.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3328-134-0x0000000000940000-0x0000000000AA0000-memory.dmp	autoit_exe
behavioral2/memory/3328-135-0x0000000000940000-0x0000000000AA0000-memory.dmp	autoit_exe
behavioral2/memory/3328-133-0x0000000000940000-0x0000000000AA0000-memory.dmp	autoit_exe
behavioral2/memory/3328-136-0x0000000000940000-0x0000000000AA0000-memory.dmp	autoit_exe
behavioral2/memory/1132-141-0x0000000000880000-0x000000000097B000-memory.dmp	autoit_exe
behavioral2/memory/1132-142-0x0000000000880000-0x000000000097B000-memory.dmp	autoit_exe
behavioral2/memory/1132-143-0x0000000000880000-0x000000000097B000-memory.dmp	autoit_exe
behavioral2/memory/3328-144-0x0000000000940000-0x0000000000AA0000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hideprocess.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\hideprocess.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exesvchost.exe

description	pid	process	target process
PID 3328 wrote to memory of 1132	3328	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 3328 wrote to memory of 1132	3328	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 3328 wrote to memory of 1132	3328	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 1132 wrote to memory of 2240	1132	svchost.exe	svchost.exe
PID 1132 wrote to memory of 2240	1132	svchost.exe	svchost.exe
PID 1132 wrote to memory of 2240	1132	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
"C:\Users\Admin\AppData\Local\Temp\b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe" /ErrorStdOut
3⤵
PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
memory/1132-141-0x0000000000880000-0x000000000097B000-memory.dmp

Filesize
1004KB

Download
memory/1132-137-0x0000000000000000-mapping.dmp

Download
memory/1132-139-0x0000000000880000-0x000000000097B000-memory.dmp

Filesize
1004KB

Download
memory/1132-142-0x0000000000880000-0x000000000097B000-memory.dmp

Filesize
1004KB

Download
memory/1132-143-0x0000000000880000-0x000000000097B000-memory.dmp

Filesize
1004KB

Download
memory/3328-133-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download
memory/3328-136-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download
memory/3328-135-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download
memory/3328-134-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download
memory/3328-132-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download
memory/3328-144-0x0000000000940000-0x0000000000AA0000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads