18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab

General

Target

18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
Size

7.1MB
MD5

b948a98ffc81a2e9bdb3680c703d91e3
SHA1

22fd215a58f3860ff13fec2fda1052a5bb7be60f
SHA256

18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab
SHA512

809df60a710f98fe2a24513d390d3305a7c9202f94a99c19d802730a2f7876235bdb09e79702dd6f359e603217b8ea1b9eb093c1f7044d7190c0a9040ce657af
SSDEEP

98304:SCKGLueukgfjvxzsDiH+9Z86SWPIsRdU3eIHhTOjZdCMw8lhmDUJgPtPn3Qq5Y6Q:7uergrvxsiHO7RrXdcglhmcgPtJ5Y

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\H:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\J:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\K:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\L:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\T:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\Y:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\B:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\G:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\O:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\S:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\V:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\E:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\N:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\P:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\Q:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\R:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\U:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\W:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\X:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\A:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\I:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
File opened (read-only)	\??\Z:	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90
PID 3540 wrote to memory of 1684	3540	18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe	90

C:\Users\Admin\AppData\Local\Temp\18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
"C:\Users\Admin\AppData\Local\Temp\18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe
  "C:\Users\Admin\AppData\Local\Temp\18866a6836f391324dc21fc1d109354df1aa3200dbdc8c766fc288906a1143ab.exe"
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-21-0x0000000001810000-0x0000000001811000-memory.dmp

Filesize
4KB

Download
memory/1684-20-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-37-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1684-36-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-35-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/1684-11-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-34-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-13-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1684-14-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-15-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1684-12-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-17-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-18-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/1684-19-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-33-0x0000000004010000-0x0000000004011000-memory.dmp

Filesize
4KB

Download
memory/1684-32-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-23-0x0000000005060000-0x0000000005063000-memory.dmp

Filesize
12KB

Download
memory/1684-31-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-22-0x0000000004010000-0x0000000004011000-memory.dmp

Filesize
4KB

Download
memory/1684-24-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-26-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1684-27-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1684-28-0x00000000017C0000-0x00000000017C1000-memory.dmp

Filesize
4KB

Download
memory/1684-29-0x0000000000BC0000-0x0000000000E53000-memory.dmp

Filesize
2.6MB

Download
memory/3540-16-0x0000000010000000-0x000000001078D000-memory.dmp

Filesize
7.6MB

Download
memory/3540-0-0x0000000000400000-0x0000000000BBF000-memory.dmp

Filesize
7.7MB

Download
memory/3540-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3540-9-0x0000000000400000-0x0000000000BBF000-memory.dmp

Filesize
7.7MB

Download
memory/3540-8-0x0000000010000000-0x000000001078D000-memory.dmp

Filesize
7.6MB

Download
memory/3540-4-0x0000000010000000-0x000000001078D000-memory.dmp

Filesize
7.6MB

Download
memory/3540-2-0x0000000010000000-0x000000001078D000-memory.dmp

Filesize
7.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads