e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a

General

Target

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
Size

297KB
MD5

430083690ac9c6c926daae9ea65ebcd0
SHA1

1e4dc96a63f36867e5e37183a46d5884b5ca4dde
SHA256

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a
SHA512

1406fced199c6aed20619f1408c2b931997ad67aed5cc27b7f019f69e0d27531673af8a527b339fafe1a4409903f639e75ed52fb9ae1de5d791dadcfdee142ba
SSDEEP

3072:YpH4IiETpBblVu/k9CaNNptwfBXb7kNQNvvPxcwr73lwjdrh8fd7t38+u9fOSQTd:i4INTzuMfNrtwf93keHC3Z+Qe7

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid process

3636 e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid	process
3636	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

description	ioc	process
File opened (read-only)	\??\X:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\W:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\K:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\J:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\Z:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\U:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\S:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\O:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\N:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\E:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\Y:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\P:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\M:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\L:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\I:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\H:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\V:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\T:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\R:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\Q:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\G:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened (read-only)	\??\F:	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Drops file in System32 directory 1 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

description ioc process

File created C:\Windows\SysWOW64\netdat.tmp e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netdat.tmp	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Drops file in Program Files directory 19 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid process

4680 e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid process

3636 e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid	process
4680	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

pid	process
3636	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

description	pid	process	target process
PID 4680 wrote to memory of 3636	4680	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
PID 4680 wrote to memory of 3636	4680	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
PID 4680 wrote to memory of 3636	4680	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe	e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

C:\Users\Admin\AppData\Local\Temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
"C:\Users\Admin\AppData\Local\Temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4680

\??\c:\users\admin\appdata\local\temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe
"C:\Users\Admin\AppData\Local\Temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Filesize
297KB

MD5
3e77a952843df15aa83868227d2dc23f

SHA1
719625f13129c714bd3670621efa96c7109b6598

SHA256
ee1dd105f0bb9694b73235b012ebbe5480df2d62399b3c92b54897c3c6f0f588

SHA512
0abc74a2ec5a3bdb9951ca2b9f7c2540686c8e9979ef61503ed1d54d4847f56be14615a5185ddd0c4caf094bd31991c79ac61ac455a9ebe08da9d25a4d5d107d

Download Submit
\??\c:\users\admin\appdata\local\temp\e14f055415d3dd999146f86ffd05017c94a7745a1144aec71b00ed53413b373a.exe

Filesize
297KB

MD5
3e77a952843df15aa83868227d2dc23f

SHA1
719625f13129c714bd3670621efa96c7109b6598

SHA256
ee1dd105f0bb9694b73235b012ebbe5480df2d62399b3c92b54897c3c6f0f588

SHA512
0abc74a2ec5a3bdb9951ca2b9f7c2540686c8e9979ef61503ed1d54d4847f56be14615a5185ddd0c4caf094bd31991c79ac61ac455a9ebe08da9d25a4d5d107d

Download Submit
memory/3636-133-0x0000000000000000-mapping.dmp

Download
memory/4680-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4680-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads