0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8

General

Target

0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe
Size

329KB
MD5

6a2d3599cd7338c1c135aa13a182cfcb
SHA1

5049ff8b4648a2aedd9c71a9fa7648c97be7a853
SHA256

0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8
SHA512

a2c33e1edd15bf2e905ded3cfc8dba048f6e7b15acc2648b180fd5677bed9c3add1a949659270d658aadf4accd3ee520279f6cdf456ce67709ff7bddac251d3d
SSDEEP

6144:Qy405m3vD4AJsEO7/KusVQcw10FqwTnYGGztm3oHzSqvvd:ajD2EOjiA0FhLYxztmoHzfvV

Score

8^/10

aspackv2 bootkit persistence spyware stealer

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000002316e-136.dat	aspack_v212_v242
behavioral2/files/0x000600000002316e-137.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
664	setup.exe
3584	Wiseman.exe
4404	Nnpng.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TFM0N = "c:\\QV4XXLXUUEEM11XL\\Nnpng.exe"	Nnpng.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	Wiseman.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\nth\\Wiseman.exe"	Wiseman.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	Nnpng.exe
File opened (read-only)	\??\a:	Nnpng.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Nnpng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Nnpng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Nnpng.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1776	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4404	Nnpng.exe
4404	Nnpng.exe
4404	Nnpng.exe
4404	Nnpng.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	setup.exe
Token: SeDebugPrivilege	664	setup.exe
Token: SeDebugPrivilege	664	setup.exe
Token: SeDebugPrivilege	4404	Nnpng.exe
Token: SeDebugPrivilege	4404	Nnpng.exe
Token: SeDebugPrivilege	4404	Nnpng.exe
Token: SeDebugPrivilege	4404	Nnpng.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
664	setup.exe
3584	Wiseman.exe
4404	Nnpng.exe
3584	Wiseman.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 664	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	82
PID 2416 wrote to memory of 664	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	82
PID 2416 wrote to memory of 664	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	82
PID 2416 wrote to memory of 3584	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	83
PID 2416 wrote to memory of 3584	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	83
PID 2416 wrote to memory of 3584	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	83
PID 2416 wrote to memory of 3400	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	84
PID 2416 wrote to memory of 3400	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	84
PID 2416 wrote to memory of 3400	2416	0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe	84
PID 3400 wrote to memory of 1776	3400	cmd.exe	86
PID 3400 wrote to memory of 1776	3400	cmd.exe	86
PID 3400 wrote to memory of 1776	3400	cmd.exe	86
PID 664 wrote to memory of 4404	664	setup.exe	87
PID 664 wrote to memory of 4404	664	setup.exe	87
PID 664 wrote to memory of 4404	664	setup.exe	87

C:\Users\Admin\AppData\Local\Temp\0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe
"C:\Users\Admin\AppData\Local\Temp\0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2416
- C:\nth\setup.exe
  "C:\nth\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:664
- - \??\c:\QV4XXLXUUEEM11XL\Nnpng.exe
    c:\QV4XXLXUUEEM11XL\Nnpng.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4404
- C:\nth\Wiseman.exe
  "C:\nth\Wiseman.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 5 127.0.0.1&&del "C:\Users\Admin\AppData\Local\Temp\0b5f917213d76fac2c11f6854a72274ed2b874e8f6939053569c9a717a069dc8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\QV4XXLXUUEEM11XL\Nnpng.exe

Filesize
60KB

MD5
665f8a5235bcc62a3b94935277f9e20a

SHA1
4de06725d6e94d8010bdd3e49b9ad7a9bdc8092e

SHA256
bcb838f78d0ae41ca49a1bbf5b686a1e4410ba1a672a55abbef6f1515992ce96

SHA512
9320880f1aece3070f21dda0788868989134bee9c206eab343f7fbe7ddb73ea5221b890559fafa01c4c5451f8d5f5df564514113bc9c75ab7703905d7ebbc5dd

Download Submit
C:\nth\Config.ini

Filesize
104KB

MD5
89fb3778d74008ce81bc6189713fa58f

SHA1
d57596200231b391cb814b70a2c15cfd40aaba54

SHA256
c9c03332b225885a8232cace800eef4b4c11462dfc4a0b07e13f23179d02ad95

SHA512
812ec605419c4874a515e5335d26a204b5ac7e077cef6704995b1a3aaa5bc8d5f953e309fe59c1bdc7cd901f0d68dd3f7c2a92ee986715a1295ffc97d795b3b4

Download Submit
C:\nth\Setup.exe

Filesize
60KB

MD5
665f8a5235bcc62a3b94935277f9e20a

SHA1
4de06725d6e94d8010bdd3e49b9ad7a9bdc8092e

SHA256
bcb838f78d0ae41ca49a1bbf5b686a1e4410ba1a672a55abbef6f1515992ce96

SHA512
9320880f1aece3070f21dda0788868989134bee9c206eab343f7fbe7ddb73ea5221b890559fafa01c4c5451f8d5f5df564514113bc9c75ab7703905d7ebbc5dd

Download Submit
C:\nth\Wiseman.exe

Filesize
111KB

MD5
22f4bf799e305f3bd2dbeb16231bb5df

SHA1
fcbdee21c6750fde20bae74aea6f1d4dcd935fd8

SHA256
51d3cb2367edfc723a0575306132865117a06816c8a692e96deba81fd82c8321

SHA512
ca56d2528a204a6e08af54bb6581ac5719582e54f147d989e8e91cc3bc92096138228c01d699a6870b0a0e427c23a333d2e6c8aaf643e7c94d605461513dff11

Download Submit
C:\nth\Wiseman.exe

Filesize
111KB

MD5
22f4bf799e305f3bd2dbeb16231bb5df

SHA1
fcbdee21c6750fde20bae74aea6f1d4dcd935fd8

SHA256
51d3cb2367edfc723a0575306132865117a06816c8a692e96deba81fd82c8321

SHA512
ca56d2528a204a6e08af54bb6581ac5719582e54f147d989e8e91cc3bc92096138228c01d699a6870b0a0e427c23a333d2e6c8aaf643e7c94d605461513dff11

Download Submit
C:\nth\setup.exe

Filesize
60KB

MD5
665f8a5235bcc62a3b94935277f9e20a

SHA1
4de06725d6e94d8010bdd3e49b9ad7a9bdc8092e

SHA256
bcb838f78d0ae41ca49a1bbf5b686a1e4410ba1a672a55abbef6f1515992ce96

SHA512
9320880f1aece3070f21dda0788868989134bee9c206eab343f7fbe7ddb73ea5221b890559fafa01c4c5451f8d5f5df564514113bc9c75ab7703905d7ebbc5dd

Download Submit
memory/664-139-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/664-152-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/664-144-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3584-145-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3584-141-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3584-140-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3584-159-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4404-158-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads