a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

General

Target

a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe
Size

124KB
MD5

2f200b6aaa6165f19d71513d311d9037
SHA1

469c214cc5fcf2b00fdbcccefff936ce4b946c31
SHA256

a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d
SHA512

9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4
SSDEEP

3072:ca4B5eRp47aJgZeqct7WBB5NcIpomk8fHDJsBqoN1NjbgSn:E524De9UyIpoPOHVOq4rbgSn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1708	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe
1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\C575E8A8-16E2-4C95-AE36-0BA9C90710B0 = "C:\\Users\\Admin\\AppData\\Local\\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\\rundll32.exe"	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27
PID 1904 wrote to memory of 1708	1904	a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe	27

C:\Users\Admin\AppData\Local\Temp\a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe
"C:\Users\Admin\AppData\Local\Temp\a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
  C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
124KB

MD5
2f200b6aaa6165f19d71513d311d9037

SHA1
469c214cc5fcf2b00fdbcccefff936ce4b946c31

SHA256
a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

SHA512
9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

Download Submit
C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
124KB

MD5
2f200b6aaa6165f19d71513d311d9037

SHA1
469c214cc5fcf2b00fdbcccefff936ce4b946c31

SHA256
a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

SHA512
9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

Download Submit
\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
124KB

MD5
2f200b6aaa6165f19d71513d311d9037

SHA1
469c214cc5fcf2b00fdbcccefff936ce4b946c31

SHA256
a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

SHA512
9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

Download Submit
\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
124KB

MD5
2f200b6aaa6165f19d71513d311d9037

SHA1
469c214cc5fcf2b00fdbcccefff936ce4b946c31

SHA256
a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

SHA512
9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

Download Submit
memory/1708-67-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1708-66-0x0000000000A40000-0x0000000000B63000-memory.dmp

Filesize
1.1MB

Download
memory/1708-65-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1904-57-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1904-63-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1904-54-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1904-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1904-55-0x0000000000720000-0x0000000000843000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing