555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb

General

Target

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
Size

182KB
MD5

6c90db6a20dae40f820de62f82af143b
SHA1

b63a7e38808e1661f033e49238a0156e86d1a5a9
SHA256

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb
SHA512

877a4b0f7c1dab3f2b1a156ed4aca09dfed14dafb4338b0f40365ebe8a15f80b43566edffd2ad79922c896635ff77f92b13573ed6584107d2abba9ec04528de0
SSDEEP

1536:x0xD3yjyvm+At4Kd0EsWqJ4S2EkyRkxP8ZSa6THmgnZ8S+39YEWTQVgGDfoHm:xUe74C03Wql25yihTHznZ8S+39CLGDU

Score

8^/10

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

description	ioc	process
File opened (read-only)	\??\S:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\W:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\G:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\J:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\R:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\K:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\P:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\Q:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\V:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\B:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\H:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\I:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\Y:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\Z:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\E:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\N:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\O:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\T:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\U:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\X:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\F:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\L:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
File opened (read-only)	\??\M:	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

pid	process
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
516	555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

pid process

516 555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe

C:\Users\Admin\AppData\Local\Temp\555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe
"C:\Users\Admin\AppData\Local\Temp\555058eed9eb1e74f21f602c62285d8248f8c3c438ab0b2bd4bfce92467d6edb.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:516