c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b

General

Target

c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
Size

2.5MB
MD5

f8297ae9a1da3649441c053a2c9a744f
SHA1

8e313553c0ae95e25cb47a5c0cec1956f3e97879
SHA256

c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b
SHA512

dcd6f48bc231d2ed5e30d58b4491dbbb7c4554bb2453d2203d8ef9384c3359dcb0eb52a9eadb7639851a7eddf4551a5666acab8a582f782dc3d04aa737ccd0c7
SSDEEP

49152:hY/OC1j4d/o6DFQagFjS5X9/MeEfOTLasY6DwOBfrnvV7UeWtzr:hYGC1EXDFf7V1wGTVYiwOBpIeWZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
828	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Loads dropped DLL 4 IoCs

pid	Process
1432	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
828	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
828	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
828	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 828	1432	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe	28
PID 1432 wrote to memory of 828	1432	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe	28
PID 1432 wrote to memory of 828	1432	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe	28
PID 1432 wrote to memory of 828	1432	c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe	28

C:\Users\Admin\AppData\Local\Temp\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
"C:\Users\Admin\AppData\Local\Temp\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe
  "C:\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Filesize
2.4MB

MD5
9f947e9df9575a71bf624bc0f0964b03

SHA1
1a3da1e360f5973f8d4726aa4b4e9ca11aa82b1e

SHA256
35de972e4b221009488c6af5a248072308c7f21a7bb9b019bf61815af2b368e3

SHA512
8e75077db8b3b50aa4fadd81d8df21f07c2304b8ea020af61b0c47e201588cd156a85170d99b0cf5501ab157c787468503ca7fe8493de52794662fc532831494

Download Submit
C:\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Filesize
2.4MB

MD5
9f947e9df9575a71bf624bc0f0964b03

SHA1
1a3da1e360f5973f8d4726aa4b4e9ca11aa82b1e

SHA256
35de972e4b221009488c6af5a248072308c7f21a7bb9b019bf61815af2b368e3

SHA512
8e75077db8b3b50aa4fadd81d8df21f07c2304b8ea020af61b0c47e201588cd156a85170d99b0cf5501ab157c787468503ca7fe8493de52794662fc532831494

Download Submit
\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\z5rcqqpp.04n\c59cfe7fdd1f4d42654ef81506cf0f1cd4d1db9fd2c3c14e7738aaa89aa6743b.exe

Filesize
2.4MB

MD5
9f947e9df9575a71bf624bc0f0964b03

SHA1
1a3da1e360f5973f8d4726aa4b4e9ca11aa82b1e

SHA256
35de972e4b221009488c6af5a248072308c7f21a7bb9b019bf61815af2b368e3

SHA512
8e75077db8b3b50aa4fadd81d8df21f07c2304b8ea020af61b0c47e201588cd156a85170d99b0cf5501ab157c787468503ca7fe8493de52794662fc532831494

Download Submit
memory/828-62-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/828-66-0x0000000000A37000-0x0000000000A48000-memory.dmp

Filesize
68KB

Download
memory/828-67-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/828-68-0x0000000000A37000-0x0000000000A48000-memory.dmp

Filesize
68KB

Download
memory/1432-61-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/1432-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1432-55-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing