6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4

General

Target

6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
Size

14.2MB
MD5

05befa7be8844d0d13e2bb82f939f8cb
SHA1

0b3ebf6e66bc69284d12e881b084c7211e9b66f4
SHA256

6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4
SHA512

7f9d7730052258e17e4d4352fc8bd55f0fe51315a5f3a25d4569c54fec9db45d0eeb5b608194d5384c7178e10b3ccab6d43c6c8c2b6cccf7553300ddb0a7c471
SSDEEP

393216:PbhMlApEV+qJBbf9XJfWLvYUAg5zFvUUQ6P6L7/AW70mhWHO+:Pd6ApEDJfAAevUBnop3O+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\O:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\T:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\V:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\E:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\G:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\K:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\Q:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\S:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\X:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\Y:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\Z:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\A:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\I:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\P:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\N:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\U:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\B:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\H:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\L:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\J:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\R:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
File opened (read-only)	\??\W:	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
4164	151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4164	1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe	92
PID 1544 wrote to memory of 4164	1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe	92
PID 1544 wrote to memory of 4164	1544	6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe	92

C:\Users\Admin\AppData\Local\Temp\6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
"C:\Users\Admin\AppData\Local\Temp\6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\ÑªÓ°Ð¡¼«Æ·222\151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
  C:\ÑªÓ°Ð¡¼«Æ·222\151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eae66bab116000866d5e0bd456f29da0.tmp

Filesize
90B

MD5
94f765bca25d99b8f46608dd2d787e73

SHA1
ce0ef597c8dee410259bac166d873489ab488734

SHA256
72ba6603340344c87bcc60e217dd9e758b85061c50194c372dac30d293171f15

SHA512
8f5ced39322f8e8932d83f7687058286d4a7d047b9026492d9af72f97194c62ab4d3308af760c144f17432cb90054bfc8beaa19843b69b8af19b987ef703944d

Download Submit
C:\ÑªÓ°Ð¡¼«Æ·222\151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Filesize
14.2MB

MD5
05befa7be8844d0d13e2bb82f939f8cb

SHA1
0b3ebf6e66bc69284d12e881b084c7211e9b66f4

SHA256
6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4

SHA512
7f9d7730052258e17e4d4352fc8bd55f0fe51315a5f3a25d4569c54fec9db45d0eeb5b608194d5384c7178e10b3ccab6d43c6c8c2b6cccf7553300ddb0a7c471

Download Submit
C:\ÑªÓ°Ð¡¼«Æ·222\151736cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4.exe

Filesize
14.2MB

MD5
05befa7be8844d0d13e2bb82f939f8cb

SHA1
0b3ebf6e66bc69284d12e881b084c7211e9b66f4

SHA256
6cd5d221e68f3a4a4913936393c1453e9a20187894575fa5ff4133cba3beadf4

SHA512
7f9d7730052258e17e4d4352fc8bd55f0fe51315a5f3a25d4569c54fec9db45d0eeb5b608194d5384c7178e10b3ccab6d43c6c8c2b6cccf7553300ddb0a7c471

Download Submit
memory/1544-1-0x0000000000B00000-0x0000000000B03000-memory.dmp

Filesize
12KB

Download
memory/1544-2-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/1544-0-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/1544-12-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/1544-13-0x0000000000B00000-0x0000000000B03000-memory.dmp

Filesize
12KB

Download
memory/4164-23-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-28-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-21-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-22-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Filesize
12KB

Download
memory/4164-11-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Filesize
12KB

Download
memory/4164-24-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-25-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-26-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-27-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-19-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-29-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-30-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-31-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-32-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-33-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-34-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-35-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-36-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download
memory/4164-37-0x0000000000400000-0x0000000000959000-memory.dmp

Filesize
5.3MB

Download

Analysis

Sharing