5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d

General

Target

5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
Size

29.5MB
MD5

f2adf37a5cddebcca73baf9ec857d281
SHA1

4324c15f25e3c93df4d85a8464cdbf5a404add22
SHA256

5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d
SHA512

4bf513a2ed85d03fb36ce858ccb416a9d3924a4ccf2b7c0ee683e4ed9c35e531b7e30b3eacbbe40763abef4e1550be7e3e539973c9b6403d113d58f0750ade7a
SSDEEP

786432:vZPj1dQUibt+82L/WtY1NpgbT//E67IDPjj:vZP56UiRl2L/n1Nm3HExf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Loads dropped DLL 4 IoCs

pid	Process
2044	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
860	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 860	2044	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe	27
PID 2044 wrote to memory of 860	2044	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe	27
PID 2044 wrote to memory of 860	2044	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe	27
PID 2044 wrote to memory of 860	2044	5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe	27

C:\Users\Admin\AppData\Local\Temp\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
"C:\Users\Admin\AppData\Local\Temp\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\temp1\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe
  "C:\Users\Admin\AppData\Local\Temp\temp1\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\x-flv-to-wmv-converter6.exe_CUSTOMEDATA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy52D4.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Filesize
29.5MB

MD5
b41058a8322ef346380e049dddfe445a

SHA1
6ac8f6060f69fd6888298e43544355ff3f67b45a

SHA256
1bec59bfe91822c36d91d7a42808886dff4c4a2426adfab12257d03f62cfc6b9

SHA512
460ac9e04437d51d01ddd96af4f7755c48cffdee70c11a737480e5de8fbc47b891717b2e55a4c066f79ea22037674d5ab327af6e8440182552c0c06cbdf02fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Filesize
29.5MB

MD5
b41058a8322ef346380e049dddfe445a

SHA1
6ac8f6060f69fd6888298e43544355ff3f67b45a

SHA256
1bec59bfe91822c36d91d7a42808886dff4c4a2426adfab12257d03f62cfc6b9

SHA512
460ac9e04437d51d01ddd96af4f7755c48cffdee70c11a737480e5de8fbc47b891717b2e55a4c066f79ea22037674d5ab327af6e8440182552c0c06cbdf02fc2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy52D4.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
\Users\Admin\AppData\Local\Temp\nsy52D4.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy52D4.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
\Users\Admin\AppData\Local\Temp\temp1\5cd36c366e7a43815874e033d7ed7a48cfa4670aef276dafd75fe042e297ea8d.exe

Filesize
29.5MB

MD5
b41058a8322ef346380e049dddfe445a

SHA1
6ac8f6060f69fd6888298e43544355ff3f67b45a

SHA256
1bec59bfe91822c36d91d7a42808886dff4c4a2426adfab12257d03f62cfc6b9

SHA512
460ac9e04437d51d01ddd96af4f7755c48cffdee70c11a737480e5de8fbc47b891717b2e55a4c066f79ea22037674d5ab327af6e8440182552c0c06cbdf02fc2

Download Submit

Analysis

Sharing