61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944

General

Target

61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe
Size

795KB
MD5

6b3c6311060e8a21921567e713688f47
SHA1

7117482ebda6e70909d3506cbc2fc484d4de3af0
SHA256

61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944
SHA512

ae3b4bf33522e565ec4f9bfa4c47086826d4920e654c110dcde0c62f8c33f82499b0ed40c5a6404712a68ac6f471cd234cb4a182eb7b51ced10b915993ba9448
SSDEEP

24576:hueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+T:huCTsdRBZbDxQqRRdfc3MncVoD+T

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1440	launch.exe
4640	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000022f5b-145.dat	nsis_installer_1
behavioral2/files/0x0006000000022f5b-145.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4640	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe
4640	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1440	4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe	79
PID 4028 wrote to memory of 1440	4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe	79
PID 4028 wrote to memory of 1440	4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe	79
PID 4028 wrote to memory of 4640	4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe	85
PID 4028 wrote to memory of 4640	4028	61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe	85

C:\Users\Admin\AppData\Local\Temp\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe
"C:\Users\Admin\AppData\Local\Temp\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe" "61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe
  C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe /path="C:\Users\Admin\AppData\Local\Temp\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\e61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
795KB

MD5
6b3c6311060e8a21921567e713688f47

SHA1
7117482ebda6e70909d3506cbc2fc484d4de3af0

SHA256
61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944

SHA512
ae3b4bf33522e565ec4f9bfa4c47086826d4920e654c110dcde0c62f8c33f82499b0ed40c5a6404712a68ac6f471cd234cb4a182eb7b51ced10b915993ba9448

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\61e4dd0c2528a8096a2b3eb6fff2aade806fc2626a30ca6fc5c5b918b29e9944.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
memory/1440-138-0x0000000073480000-0x0000000073A31000-memory.dmp

Filesize
5.7MB

Download
memory/1440-136-0x0000000073480000-0x0000000073A31000-memory.dmp

Filesize
5.7MB

Download
memory/1440-132-0x0000000000000000-mapping.dmp

Download
memory/4640-139-0x0000000000000000-mapping.dmp

Download
memory/4640-143-0x00007FFFEC370000-0x00007FFFECDA6000-memory.dmp

Filesize
10.2MB

Download
memory/4640-144-0x0000000000C1A000-0x0000000000C1F000-memory.dmp

Filesize
20KB

Download
memory/4640-146-0x0000000000C1A000-0x0000000000C1F000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing