9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1

General

Target

9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
Size

179KB
MD5

79372dcbf9858b005729da221561b2aa
SHA1

a499819f0659340a5d9ea72d4aa3c2189908551a
SHA256

9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1
SHA512

baef407ec4dac0fa792932546bd762c5d9c3e360f281ce4014700115946ff04560c09499e72a1ce4fc28940cd86080ddf8fdb41a4bbc599e00e432a28949855b
SSDEEP

3072:ABAp5XhKpN4eOyVTGfhEClj8jTk+0hvXUDFY/2g3xrpr:3bXE9OiTGfhEClq9QUDF2

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1664	WScript.exe
4	1664	WScript.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\1\2\gam.txt	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\sogazr.bat	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\daet.vbs	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\ekstaz.vbs	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\kids.txt	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1728	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	28
PID 1132 wrote to memory of 1728	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	28
PID 1132 wrote to memory of 1728	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	28
PID 1132 wrote to memory of 1728	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	28
PID 1132 wrote to memory of 1664	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	30
PID 1132 wrote to memory of 1664	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	30
PID 1132 wrote to memory of 1664	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	30
PID 1132 wrote to memory of 1664	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	30
PID 1132 wrote to memory of 1548	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	31
PID 1132 wrote to memory of 1548	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	31
PID 1132 wrote to memory of 1548	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	31
PID 1132 wrote to memory of 1548	1132	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	31

C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
"C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\1\2\sogazr.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1728
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\daet.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\ekstaz.vbs"
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\1\2\daet.vbs

Filesize
547B

MD5
232aa0068739f14ea68404c1dcb71929

SHA1
c70a0711fd6b9f38260b1c6dcb43e97ca2ad06a7

SHA256
8530396ddc8187a992d6561d04cb8a1726acf9ec299452e5395ac3aefce8d95b

SHA512
67717519e6df96404468a0a4af3ff7b3af5c136b7715f5955b6ddebc4b7ffae8d1c679d782511843e694336c2e6ec62e1a55af99d64c46adec20f777caca9d23

Download Submit
C:\Program Files (x86)\1\2\ekstaz.vbs

Filesize
588B

MD5
89031d9b74652f0be426774267586b8d

SHA1
7fd55000c315bcbd55ff51ed7b0ca201e978a8dc

SHA256
b50e00e042f97ad4e848444c9b2281e9dbb03dec367b53fcbe376e54c1e8fd4b

SHA512
fa0f2b5d94a14934c5ff100ef90c8a4af8686abeb4b67f02fc15d25f5181ec705b2182e22ed88be8647e5d87e5467db5f6a4d04d71edb55ff167a64e9cd5f40f

Download Submit
C:\Program Files (x86)\1\2\kids.txt

Filesize
5B

MD5
8249407cf0da9a987b8d09ce7f4d2979

SHA1
73c63d88a3fc1f87e6c66e437b458c1826efca8e

SHA256
d9caa2357f1ea7b8b1d10caf71f96e52e19b7446f017eea5f197710b650938a2

SHA512
f6d066137a051bee999489167da6f31d5a71ef0a127f286f8aebb2a9cc9f2437a06b37e5e5b671bd0344fbec45c79c6b8ddb2b1ab797a9a08bbb017d00fd6d26

Download Submit
C:\Program Files (x86)\1\2\sogazr.bat

Filesize
3KB

MD5
eadc34423f9258a670719eb7e2897f6a

SHA1
8a3a364c70fb77148c345a709f62dece838900e0

SHA256
033ace201e06b89a6689dd64f61afb047fbdf1bf10d0d96b8a2bc2de9ae77560

SHA512
bf2981bab0604962e235dbad6422b7d779bdf63e1578ba2a61f9f894c0a72725e809d6b1d1364642b6d4411c7183711bfad1a6a9efb86e014f5d692d3df20b9e

Download Submit
memory/1132-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing