2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a

General

Target

2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
Size

29.0MB
MD5

a6f796b3e8208c252321379e982e5a93
SHA1

5c70f51021ecf050325b69e688fe4432eceb140f
SHA256

2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a
SHA512

66cff9ca51d6a456ceed8af8502075498e05442be18b8feed8ef35df132c1244d71869acb71176a85eb6e93ca4caaae67bf86b2a1acfb44e55ca2e11be0e70cd
SSDEEP

786432:vT+Nnthlxwqc4lJ+Q2Ed+O7wsNSyd6ZeWeUeEL2b1lL:vTwnZp2kws4x9eUeELcR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Loads dropped DLL 4 IoCs

pid	Process
1200	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1728	1200	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe	28
PID 1200 wrote to memory of 1728	1200	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe	28
PID 1200 wrote to memory of 1728	1200	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe	28
PID 1200 wrote to memory of 1728	1200	2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe	28

C:\Users\Admin\AppData\Local\Temp\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
"C:\Users\Admin\AppData\Local\Temp\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\temp1\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe
  "C:\Users\Admin\AppData\Local\Temp\temp1\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\x-zune-video-converter6.exe_CUSTOMEDATA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy1326.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Filesize
28.9MB

MD5
31e972b26125738c4753191fe3f94214

SHA1
f9fa5b9b5d5d443bae826930e51c02e003063780

SHA256
61167705016e48338df1855279c2f106f023c22e195cc83cf83ce665b343e022

SHA512
766f46043caf186e120fd430c2f48bf873e18674834ef048da1086ecdcdb0ac18996216993eb182f2e6e90355c55b4ff0dcc2494b7b021ab1297c0d18c33bab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Filesize
28.9MB

MD5
31e972b26125738c4753191fe3f94214

SHA1
f9fa5b9b5d5d443bae826930e51c02e003063780

SHA256
61167705016e48338df1855279c2f106f023c22e195cc83cf83ce665b343e022

SHA512
766f46043caf186e120fd430c2f48bf873e18674834ef048da1086ecdcdb0ac18996216993eb182f2e6e90355c55b4ff0dcc2494b7b021ab1297c0d18c33bab3

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1326.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1326.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1326.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
\Users\Admin\AppData\Local\Temp\temp1\2590079529159957397451eda9ff5457fd06f26cf13d58304a67a60fcede475a.exe

Filesize
28.9MB

MD5
31e972b26125738c4753191fe3f94214

SHA1
f9fa5b9b5d5d443bae826930e51c02e003063780

SHA256
61167705016e48338df1855279c2f106f023c22e195cc83cf83ce665b343e022

SHA512
766f46043caf186e120fd430c2f48bf873e18674834ef048da1086ecdcdb0ac18996216993eb182f2e6e90355c55b4ff0dcc2494b7b021ab1297c0d18c33bab3

Download Submit

Analysis

Sharing