cc7b7c80fcb3d14fdc1dd35b617061de9efbc54e73ddb6c2cb46b46e3ccedebd

General

Target

file.exe
Size

1.3MB
MD5

ea5d0b2e405840eb71f760eaf6bbff6e
SHA1

5dc6ba3743f47b4dba4af9d7a25b0858e97ef31b
SHA256

cc7b7c80fcb3d14fdc1dd35b617061de9efbc54e73ddb6c2cb46b46e3ccedebd
SHA512

01eb070c78233d33977108f3b8f894aa7bdd4bacecee3239f5ddb1c47d2973fe7d01bde62ae3d60b3bdc94f2d571846b6b4228b523d1605ff978e059978c3b6c
SSDEEP

24576:q20ITfWw961ZEwfNjH6BeRLUQ70lm0/wFV/AITA8DtK1WygXC75ld1qSVpk:q2b61PtE4PIlm0/MAIM8EBd1qapk

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2972	file.tmp
4644	LitFiles137.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	file.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Split Files\language\is-DUL8H.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-ALUAA.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-UKNQF.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-2NTBV.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-FDBQ2.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\is-GULEE.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\is-6DPGP.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-VHSFF.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-PE2FJ.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\is-HM41O.tmp	file.tmp
File opened for modification	C:\Program Files (x86)\Split Files\unins000.dat	file.tmp
File created	C:\Program Files (x86)\Split Files\unins000.dat	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-OGIB1.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\language\is-2VLDP.tmp	file.tmp
File opened for modification	C:\Program Files (x86)\Split Files\LitFiles137.exe	file.tmp
File created	C:\Program Files (x86)\Split Files\is-MDNJP.tmp	file.tmp
File created	C:\Program Files (x86)\Split Files\is-J7DD2.tmp	file.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2972	1764	file.exe	76
PID 1764 wrote to memory of 2972	1764	file.exe	76
PID 1764 wrote to memory of 2972	1764	file.exe	76
PID 2972 wrote to memory of 4644	2972	file.tmp	77
PID 2972 wrote to memory of 4644	2972	file.tmp	77
PID 2972 wrote to memory of 4644	2972	file.tmp	77

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\is-P9412.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P9412.tmp\file.tmp" /SL5="$7014A,1083206,212992,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Split Files\LitFiles137.exe
    "C:\Program Files (x86)\Split Files\LitFiles137.exe"
    3⤵
    - Executes dropped EXE
    PID:4644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Split Files\LitFiles137.exe

Filesize
1.8MB

MD5
47cfc8b900b680fb9262f4c2dd06dbbc

SHA1
82f8a09ecdf7c8a5c7b82112650cc572ca6259fc

SHA256
2d62647e9083e4495556b200b3d20aae35abf8c31dfc6dbe85f326088d8c6710

SHA512
a78957a64a45fee90fa0de4c3e2c99c40e31bacb7bf1ffa90b86c3f1749ebda99c93904a7b5922c609a32f6a537eb86404c8b506c0bf85e8357cac822eafdc3c

Download Submit
C:\Program Files (x86)\Split Files\LitFiles137.exe

Filesize
1.8MB

MD5
47cfc8b900b680fb9262f4c2dd06dbbc

SHA1
82f8a09ecdf7c8a5c7b82112650cc572ca6259fc

SHA256
2d62647e9083e4495556b200b3d20aae35abf8c31dfc6dbe85f326088d8c6710

SHA512
a78957a64a45fee90fa0de4c3e2c99c40e31bacb7bf1ffa90b86c3f1749ebda99c93904a7b5922c609a32f6a537eb86404c8b506c0bf85e8357cac822eafdc3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HMOF7.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P9412.tmp\file.tmp

Filesize
695KB

MD5
415533bb40980951c966665cff9e2fe7

SHA1
fce396c8fa01876dd008f22c8be9a9b706f4aaec

SHA256
f688364bb17f03e53de641e7a0b0efefe30ac155fa9fa414a2150204ed9d3734

SHA512
3a8f88fa83e9f8be96fc9a0e8b47536455f50b1c511210d98fa178444b1e5ad1943cc3000e869f6dba4c782b48a3538d0b52d5e29ce3a692636aefc0e52083ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P9412.tmp\file.tmp

Filesize
695KB

MD5
415533bb40980951c966665cff9e2fe7

SHA1
fce396c8fa01876dd008f22c8be9a9b706f4aaec

SHA256
f688364bb17f03e53de641e7a0b0efefe30ac155fa9fa414a2150204ed9d3734

SHA512
3a8f88fa83e9f8be96fc9a0e8b47536455f50b1c511210d98fa178444b1e5ad1943cc3000e869f6dba4c782b48a3538d0b52d5e29ce3a692636aefc0e52083ae

Download Submit
memory/1764-132-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1764-141-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1764-142-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-143-0x0000000000400000-0x00000000013C2000-memory.dmp

Filesize
15.8MB

Download
memory/4644-144-0x0000000000400000-0x00000000013C2000-memory.dmp

Filesize
15.8MB

Download

Analysis

Sharing