bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595

General

Target

bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
Size

4.0MB
MD5

dcc1e9ae4889afdd37011d7c736a6e3c
SHA1

4dd50d7b6d90fc2ba8a674370119896074946679
SHA256

bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595
SHA512

0c136136e7a63585a1c05e6a18c09ddff13339e3e5ba4fba763b04b253b3f302265801ea33602a2c2e075319a3d70b63e19e0e6baf8030fb1b245ce64b8e6e51
SSDEEP

98304:5QT0r4bf5EpgN+XIvmgJjB4kMNJlfzoSqzChB+Ji1HwSykHP6rB:Hr4bfmW+iHVBpmJhCzAB+Ji1HHy+yrB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
1952	bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	224	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe
"C:\Users\Admin\AppData\Local\Temp\bfd0c3464b5a707a14c682a75fadf4f5b787b44ff8d2783078137e45e42c6595.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e4 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NSISUtils\msvcr71.dll

Filesize
340KB

MD5
86f1895ae8c5e8b17d99ece768a70732

SHA1
d5502a1d00787d68f548ddeebbde1eca5e2b38ca

SHA256
8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe

SHA512
3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSISUtils\nsisutils.dll

Filesize
4KB

MD5
03a477dd69bd11877e2ac1953947c400

SHA1
e33881e8203674cc94bc9fcbde3e1f65ed4be5c7

SHA256
03c50276af73bb72b533f8936a57bbabe41e3b7d5e24cf60eb32f3b9df2cdd61

SHA512
c8d657199b7c2e2d3c9d76897426b1b9f227bd9d341481f059ab1ae6d79514e94620ec6434e32a6a07095350c90a80bfa46384cef12e309ba6f661d2ddac81af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\bassmod.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\bassmod.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\brandingurl.dll

Filesize
3KB

MD5
9c3488b5e9655d1837c3963ecec33f70

SHA1
f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

SHA256
05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

SHA512
6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\installoptions.dll

Filesize
12KB

MD5
cce5450725a9429a1d3c7aa851d40e8d

SHA1
05722500e42757ac03f2558452a064b906e31937

SHA256
d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

SHA512
3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\installoptions.dll

Filesize
12KB

MD5
cce5450725a9429a1d3c7aa851d40e8d

SHA1
05722500e42757ac03f2558452a064b906e31937

SHA256
d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

SHA512
3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB8D7.tmp\system.dll

Filesize
10KB

MD5
24a04541a0d2312e472f8236fd205ea8

SHA1
c47eeee6fc23590311f2860d80baa954386a8ce9

SHA256
74d7ac9e94305c3d30cfc19279ee73fa891bd5ae8800610dee391d1880825e19

SHA512
65e061d2776bc0db53ea8aa35fb50152818c74fa9735f1a5a370315c4dacaf2cb79374ec59174d86c2e87f5b0bb8662f8cee6ff97ae93261c9a9a05bd3cc1adf

Download Submit
memory/1952-135-0x00000000039D0000-0x00000000039E3000-memory.dmp

Filesize
76KB

Download
memory/1952-141-0x0000000003D21000-0x0000000003D23000-memory.dmp

Filesize
8KB

Download
memory/1952-142-0x00000000039D0000-0x00000000039E3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing