18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8

General

Target

18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
Size

177KB
MD5

038ad47c0e89f42b66ed2a72a70b1812
SHA1

ee504abfd0369f274e8347b2b592b9c546cf825c
SHA256

18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8
SHA512

21f25d832ea5022887c7e50c01724a2567f55fd3482221b8f0525eafe6cbf30a9eca4b2f2dae687e34cabc4cc9de921fecbb42afb54a1ab03456667d634d3e95
SSDEEP

3072:7hxkoCDLHmrAntgPGjuod42yS51XFnndUKiXNb:NwDjmrqlNH/Xlndhy

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
1340	regedit.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1320	1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe	27
PID 1412 wrote to memory of 1320	1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe	27
PID 1412 wrote to memory of 1320	1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe	27
PID 1412 wrote to memory of 1320	1412	18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe	27
PID 1320 wrote to memory of 1340	1320	regedt32.exe	28
PID 1320 wrote to memory of 1340	1320	regedt32.exe	28
PID 1320 wrote to memory of 1340	1320	regedt32.exe	28
PID 1320 wrote to memory of 1340	1320	regedt32.exe	28

C:\Users\Admin\AppData\Local\Temp\18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe
"C:\Users\Admin\AppData\Local\Temp\18655503f0c9d381006e25bdc856d6a0364be810ff16cebc26b53eddd7641ee8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\System32\regedt32.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
    3⤵
    - Runs .reg file with regedit
    PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Iterra\T03emp03.reg

Filesize
217B

MD5
8c22ec3e5fa42de4469afa6e780b3c95

SHA1
dd48a922f40c118a757ebe509198412c37113e88

SHA256
316c538a79d417cf2d85eddf31bdda14a7d340be84d6ed0cc9e64e6f9cf7b97a

SHA512
1d1f79dbb939416fa39f2f79ce01decb5db8793001bafe9fe0ad59bdcf73e8d3ed2f486773ab4b76928db9c230095abeb2add40c683441b30f600361e77c3578

Download Submit
\Users\Admin\Documents\Iterra\rcnimwh.dll

Filesize
41KB

MD5
530c4079c568f5f9163fa9b2c7f1a678

SHA1
5eb96e204991664a4d3b2b17cf7756714179cb65

SHA256
349f8c958b7ac3f3c8ff08543145e7cc9b044fd676d879da11b026cd72b884e5

SHA512
27f90798ba757fbc4320248f093fe107ccad090319b35929291c7353f6878df43f8045715682b4d27f3efccef9bd37293a0ac4c3640a4d0093485689efa98596

Download Submit
memory/1412-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1412-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1412-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1412-63-0x0000000002730000-0x0000000002803000-memory.dmp

Filesize
844KB

Download
memory/1412-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1412-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing