061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b

General

Target

061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
Size

8.6MB
MD5

803b8792cb30f71bcbfc75a199c11e37
SHA1

f8fde346b0ad3a0d14ee25f0e0fb0b1a9eaebb22
SHA256

061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b
SHA512

6075adbd5ab935eaa28ab63aa7aa161db5ee4071453ddc5dd63eb1c7ff384da9227eb8d074c8a12bcc72de84d49181f26e611fa1af548bf40603c975b58e748f
SSDEEP

196608:567jTMfOQI0krjVJHpLpLdD7ZzNS/AFZsYEMJnx8Yc3qwfyni4:5oTwm3VlhtZ1pNFOYEQnGf6

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\L:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\M:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\O:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\Q:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\B:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\G:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\I:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\V:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\X:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\H:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\N:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\T:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\W:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\Z:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\J:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\R:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\S:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\U:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\Y:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\A:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\E:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
File opened (read-only)	\??\P:	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83
PID 1812 wrote to memory of 644	1812	061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe	83

C:\Users\Admin\AppData\Local\Temp\061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
"C:\Users\Admin\AppData\Local\Temp\061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe
  "C:\Users\Admin\AppData\Local\Temp\061bc94c5b1929af9accf67c6c7dfa84e7cdc590925f6737cedbc5e99489a53b.exe"
  2⤵
  - Enumerates connected drives
  PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-164-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-143-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/644-172-0x0000000005F00000-0x0000000005FB7000-memory.dmp

Filesize
732KB

Download
memory/644-171-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/644-139-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-147-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-148-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/644-149-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-144-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-150-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-152-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/644-153-0x00000000037C0000-0x00000000037C1000-memory.dmp

Filesize
4KB

Download
memory/644-154-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/644-151-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-170-0x00000000057B0000-0x00000000057B3000-memory.dmp

Filesize
12KB

Download
memory/644-145-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/644-169-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/644-167-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/644-155-0x00000000057B0000-0x00000000057B3000-memory.dmp

Filesize
12KB

Download
memory/644-156-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/644-158-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/644-159-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/644-160-0x0000000005F00000-0x0000000005FB7000-memory.dmp

Filesize
732KB

Download
memory/644-162-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/644-166-0x0000000000EA0000-0x0000000001145000-memory.dmp

Filesize
2.6MB

Download
memory/644-165-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/1812-133-0x0000000000400000-0x0000000000E98000-memory.dmp

Filesize
10.6MB

Download
memory/1812-141-0x0000000010000000-0x00000000108DD000-memory.dmp

Filesize
8.9MB

Download
memory/1812-146-0x0000000000400000-0x0000000000E98000-memory.dmp

Filesize
10.6MB

Download
memory/1812-134-0x0000000002C00000-0x0000000002C03000-memory.dmp

Filesize
12KB

Download
memory/1812-136-0x0000000010000000-0x00000000108DD000-memory.dmp

Filesize
8.9MB

Download
memory/1812-135-0x0000000010000000-0x00000000108DD000-memory.dmp

Filesize
8.9MB

Download

Analysis

Sharing