5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47

General

Target

5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
Size

29.0MB
MD5

6e5108979ecf6bd5359391f3b5b46735
SHA1

c5a0ee55a75bf6c68b92af8e1d298beba9002702
SHA256

5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47
SHA512

55f54fb9d8ad7d9817a5b04722fbd64684de57e726eb2c38eb605c48d587bec5c997170517bb3b059324f8cc20c2ea161db6133be7865d4e26ab89543e718de1
SSDEEP

786432:vdEtlGrsI5c4SVQ5phD47YijE13cmPUmmTaR:vdx1cl4qcN11c2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Loads dropped DLL 4 IoCs

pid	Process
1776	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1584	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1584	1776	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe	28
PID 1776 wrote to memory of 1584	1776	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe	28
PID 1776 wrote to memory of 1584	1776	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe	28
PID 1776 wrote to memory of 1584	1776	5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe	28

C:\Users\Admin\AppData\Local\Temp\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
"C:\Users\Admin\AppData\Local\Temp\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\temp1\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe
  "C:\Users\Admin\AppData\Local\Temp\temp1\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\x-ipad-video-converter6.exe_CUSTOMEDATA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Filesize
28.9MB

MD5
8a537b44949337ebcbbd39f755b3b381

SHA1
385a9ea80df42d69b742dc27e40bd9bac3c52ae3

SHA256
1b802661e77d12984668d4ee3ae45ebea21ed89081818af2938762c798b8a37a

SHA512
f8195780a6f88f2131673e01a5dd3995039deb584fd8acd7b278497a2bf3ccf549288b4c941cc63a61f040e79a315d6257b1b43aae0741d82ccde062886492f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Filesize
28.9MB

MD5
8a537b44949337ebcbbd39f755b3b381

SHA1
385a9ea80df42d69b742dc27e40bd9bac3c52ae3

SHA256
1b802661e77d12984668d4ee3ae45ebea21ed89081818af2938762c798b8a37a

SHA512
f8195780a6f88f2131673e01a5dd3995039deb584fd8acd7b278497a2bf3ccf549288b4c941cc63a61f040e79a315d6257b1b43aae0741d82ccde062886492f0

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
\Users\Admin\AppData\Local\Temp\temp1\5c7b360d1766cb3842a17158372985a5014d109375d99c0e4a52b7c22b64ae47.exe

Filesize
28.9MB

MD5
8a537b44949337ebcbbd39f755b3b381

SHA1
385a9ea80df42d69b742dc27e40bd9bac3c52ae3

SHA256
1b802661e77d12984668d4ee3ae45ebea21ed89081818af2938762c798b8a37a

SHA512
f8195780a6f88f2131673e01a5dd3995039deb584fd8acd7b278497a2bf3ccf549288b4c941cc63a61f040e79a315d6257b1b43aae0741d82ccde062886492f0

Download Submit

Analysis

Sharing