7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d

General

Target

adusetupipg_googleadw-adu_gads_usa_ext.exe
Size

8.8MB
MD5

2335a750096cb245737b423794866a82
SHA1

29c676cf08535b01889a94bd181bc22f5d70459e
SHA256

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d
SHA512

6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9
SSDEEP

196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

adusetupipg_googleadw-adu_gads_usa_ext.tmp

pid process

216 adusetupipg_googleadw-adu_gads_usa_ext.tmp
Loads dropped DLL 1 IoCs

Processes:

adusetupipg_googleadw-adu_gads_usa_ext.tmp

pid process

216 adusetupipg_googleadw-adu_gads_usa_ext.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4636 taskkill.exe
952 taskkill.exe
3960 taskkill.exe
4568 taskkill.exe

pid	process
216	adusetupipg_googleadw-adu_gads_usa_ext.tmp

pid	process
216	adusetupipg_googleadw-adu_gads_usa_ext.tmp

pid	process
4636	taskkill.exe
952	taskkill.exe
3960	taskkill.exe
4568	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

adusetupipg_googleadw-adu_gads_usa_ext.exeadusetupipg_googleadw-adu_gads_usa_ext.tmp

description	pid	process	target process
PID 996 wrote to memory of 216	996	adusetupipg_googleadw-adu_gads_usa_ext.exe	adusetupipg_googleadw-adu_gads_usa_ext.tmp
PID 996 wrote to memory of 216	996	adusetupipg_googleadw-adu_gads_usa_ext.exe	adusetupipg_googleadw-adu_gads_usa_ext.tmp
PID 996 wrote to memory of 216	996	adusetupipg_googleadw-adu_gads_usa_ext.exe	adusetupipg_googleadw-adu_gads_usa_ext.tmp
PID 216 wrote to memory of 4636	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 4636	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 4636	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 952	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 952	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 952	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 3960	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 3960	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 3960	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 4568	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 4568	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe
PID 216 wrote to memory of 4568	216	adusetupipg_googleadw-adu_gads_usa_ext.tmp	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe
"C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp" /SL5="$4021A,8637066,199680,C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp

Filesize
1.2MB

MD5
cd31650b1825f94d40916975931def27

SHA1
797184e1856305b590ea138f6fa4139499c1f60b

SHA256
04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

SHA512
13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp

Filesize
1.2MB

MD5
cd31650b1825f94d40916975931def27

SHA1
797184e1856305b590ea138f6fa4139499c1f60b

SHA256
04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

SHA512
13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4V5FM.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\ipini.ini

Filesize
12B

MD5
71d587e911373f62d72a158eceb6e0e7

SHA1
68d81a1a4fb19c609288a94f10d1bbb92d972a68

SHA256
acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8

SHA512
a0010c487c8b1eeae82ae82896bf5f48b7ec5573197bbe149b6803093a32b3b470ef0b122278e404cd5df296376bb0629438609997d52c14757ff1c3e6756060

Download Submit
memory/216-7-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/216-29-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/216-30-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/996-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/996-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing