749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
Size 565KB
Sample231011-hrfgmaae22
SHA256 749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4
MD5 27601d095e5b3761d9289584415a73cc
SHA1 9570f23b5abe2ef46a23ded17adb2fb6c203a201
SHA512 066263bf8f11d48b4e3715b8962686e0ca32aa8647b642a193b5331513538a44bb49edad5ef6a08ae6cc6401504fadc7adf38efb07c9ae9560e947aac443e0e7
SSDEEP 12288:REqmA0wfzInoQJUi1KHvQtzDNfo1arLaLRvs+Jkp/eH:RHmSyo+Ui13zZCI7+up/eH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3088	WombatStarter.exe
840	HPWombatSrv.exe
1652	WombatStarter.exe

Loads dropped DLL 3 IoCs

pid	Process
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\1.ico	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\2.ico	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\3.ico	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\4.ico	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\5.ico	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\HPWombatSrv.exe	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\WombatStarter.exe	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
File created	C:\Program Files (x86)\HPWombat\uninstaller.exe	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	HPWombatSrv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3088	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	86
PID 996 wrote to memory of 3088	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	86
PID 996 wrote to memory of 3088	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	86
PID 996 wrote to memory of 1652	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	95
PID 996 wrote to memory of 1652	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	95
PID 996 wrote to memory of 1652	996	749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe	95

C:\Users\Admin\AppData\Local\Temp\749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe
"C:\Users\Admin\AppData\Local\Temp\749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\HPWombat\WombatStarter.exe
  "C:\Program Files (x86)\HPWombat\WombatStarter.exe" "install_and_start_srv" "C:\Users\Admin\AppData\Local\Temp\749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe"
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Program Files (x86)\HPWombat\WombatStarter.exe
  "C:\Program Files (x86)\HPWombat\WombatStarter.exe" "write_patch_str_to_reg" "C:\Users\Admin\AppData\Local\Temp\749f5e042b317dc4e989c174d92936ef83d9d4fbf4c190f0e5b759b858b15cf4.exe" "HKLM" Software\HPWombat "jeromu"
  2⤵
  - Executes dropped EXE
  PID:1652

C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
"C:\Program Files (x86)\HPWombat\HPWombatSrv.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HPWombatSrv.exe

Path C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
Size 2.4MB
SHA256 18dd7fe65140120d10004e475effb1ce386d8f280094429f4654882120899d73
MD5 bac2e4856879885af0251cb4cbb3d521
SHA1 a8d3f6492e20e775c84f16a8ca6683a2c1aabc2d
SHA512 5d550a67764a54145808a12953435a5dd75d1bea8200f2872e288f1eb9f8c0b798db539289950b2c42a0cac4a55689fc65427d1c97afdf83a10881a74d7a1935
SSDEEP 49152:UA/tFdVwUdh6HkoFewRCaX0j6KoXvZB965pTSI35PurmGvBBBElRYpEUq6:NAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

HPWombatSrv.exe

Path C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
Size 2.4MB
SHA256 18dd7fe65140120d10004e475effb1ce386d8f280094429f4654882120899d73
MD5 bac2e4856879885af0251cb4cbb3d521
SHA1 a8d3f6492e20e775c84f16a8ca6683a2c1aabc2d
SHA512 5d550a67764a54145808a12953435a5dd75d1bea8200f2872e288f1eb9f8c0b798db539289950b2c42a0cac4a55689fc65427d1c97afdf83a10881a74d7a1935
SSDEEP 49152:UA/tFdVwUdh6HkoFewRCaX0j6KoXvZB965pTSI35PurmGvBBBElRYpEUq6:NAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

WombatStarter.exe

Path C:\Program Files (x86)\HPWombat\WombatStarter.exe
Size 1.3MB
SHA256 78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70
MD5 d23253f3a323a0a7c8ecfb08e1e0aa74
SHA1 497bbf7fa1655f7fd921239a00d46c32acebf59d
SHA512 cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d
SSDEEP 24576:f3y6h/OCC1WQa+OoMr8xNgLT5oEJDoI/qB0EBBBUGGxdb1EbYh186Wl7:ngCC1WQa+OoMr8xNgLT5oK/6BBBUNxd8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WombatStarter.exe

Path C:\Program Files (x86)\HPWombat\WombatStarter.exe
Size 1.3MB
SHA256 78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70
MD5 d23253f3a323a0a7c8ecfb08e1e0aa74
SHA1 497bbf7fa1655f7fd921239a00d46c32acebf59d
SHA512 cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d
SSDEEP 24576:f3y6h/OCC1WQa+OoMr8xNgLT5oEJDoI/qB0EBBBUGGxdb1EbYh186Wl7:ngCC1WQa+OoMr8xNgLT5oK/6BBBUNxd8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WombatStarter.exe

Path C:\Program Files (x86)\HPWombat\WombatStarter.exe
Size 1.3MB
SHA256 78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70
MD5 d23253f3a323a0a7c8ecfb08e1e0aa74
SHA1 497bbf7fa1655f7fd921239a00d46c32acebf59d
SHA512 cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d
SSDEEP 24576:f3y6h/OCC1WQa+OoMr8xNgLT5oEJDoI/qB0EBBBUGGxdb1EbYh186Wl7:ngCC1WQa+OoMr8xNgLT5oK/6BBBUNxd8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firеfох.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firеfох.lnk
Size 2KB
SHA256 05a9e6bfdbe7f306449ced93aec7a623378aa2be37274dd197fff05586f976d6
MD5 3d521aeffa6722df243992e26705e67b
SHA1 45e26aa0984d6371f621312f3bb9361bd21dbbd7
SHA512 c0dab98b3e3efa35aa0c95ec1842e47675c926765a9265b1bdb1102e0bc37c6e53c3324df906f64716984af3c0af9a6d1f7e07ccf918e7f1f7af81a9d773301c
MD5 SHA1 SHA512

Submit Download

Gооglе Сhrоmе.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gооglе Сhrоmе.lnk
Size 2KB
SHA256 36f7cd1248eb690379a1899d816eeee05c885bc9520056fcee4ebed9d8f681ac
MD5 7cff3f946728d62da3af5d595700fe95
SHA1 3f8d0484081f505ba493b902efb4743c93a6e7cd
SHA512 f9702dc5ca454339eb249056e3474e72f8c4194a155d6d395bf362a4e760a778fcd042a789a77c732fdfdaa5842b67482b4f2ddd777be81a8900987626a0bdf2
MD5 SHA1 SHA512

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7E5A.tmp\inetc.dll
Size 24KB
SHA256 7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b
MD5 0f70de5c22874df2323f937f7b588bd4
SHA1 ed306624cd687d9e506c7ecd2ac97b7aaf556ff6
SHA512 9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e
SSDEEP 384:Tr9e9dQQaneg3Hoyv4JedCUiFa6NP2JcOeh+tpwZwcSyeEaASMbRW:/AvQQanX6edxijd2SXQs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7E5A.tmp\inetc.dll
Size 24KB
SHA256 7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b
MD5 0f70de5c22874df2323f937f7b588bd4
SHA1 ed306624cd687d9e506c7ecd2ac97b7aaf556ff6
SHA512 9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e
SSDEEP 384:Tr9e9dQQaneg3Hoyv4JedCUiFa6NP2JcOeh+tpwZwcSyeEaASMbRW:/AvQQanX6edxijd2SXQs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7E5A.tmp\inetc.dll
Size 24KB
SHA256 7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b
MD5 0f70de5c22874df2323f937f7b588bd4
SHA1 ed306624cd687d9e506c7ecd2ac97b7aaf556ff6
SHA512 9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e
SSDEEP 384:Tr9e9dQQaneg3Hoyv4JedCUiFa6NP2JcOeh+tpwZwcSyeEaASMbRW:/AvQQanX6edxijd2SXQs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7E5A.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7E5A.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firеfох.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firеfох.lnk
Size 2KB
SHA256 bc652aa1d718b9650b1af9b7b5893e4c1a7de47ee739d18595baa87cdb62e17e
MD5 5019f119ab6d0932d3af94edf3473415
SHA1 2ffdc7d3d7e9f862d636a58f801a10890b04f7c6
SHA512 8d0a25c6bb56c97d850762ca369f574d7eb984b4ee43ff23beb998127f98aff71ec97ade91da9d1058b31b108a884e2b58f3129cf8f1a03b5a0bca449e27ceb0
MD5 SHA1 SHA512

Submit Download

Intеrnеt Ехрlоrеr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Ехрlоrеr.lnk
Size 2KB
SHA256 68f13ac1a2e1455d30207a2efe3a13ca6e4187f986658d95b095c8e81ab601b1
MD5 c068d53d7df2e4c0128489823419b43f
SHA1 f7f5117fc33c683f48f4725dd72f665d4c2c1ea2
SHA512 e365cfb033353bbea4745807a19687321d6f12247e94093b223a6775a31215fb89ef8749de97b98e62955b48b58f08b017b4d6dea2c0c96f20312af96cbd9a4e
MD5 SHA1 SHA512

Submit Download

Firеfох.lnk

Path C:\Users\Public\Desktop\Firеfох.lnk
Size 2KB
SHA256 5d0c604143558e019acdd617a5c3fd08609ff72c642cc14fde4a1883ebd8b4cb
MD5 9188c33dca624f52a7c19eddc17192a1
SHA1 20ad1e85e63773a1a94a73a768a518e60a6b645e
SHA512 b26f0b260715055fbaa224f1dd50f10d493d449a5818555f75319c3a3f78ba404efeda6888b383a3cebd3a6b5b29fb783757d8dd06d994eaa4e14fb9c98449f1
MD5 SHA1 SHA512

Submit Download

Gооglе Сhrоmе.lnk

Path C:\Users\Public\Desktop\Gооglе Сhrоmе.lnk
Size 2KB
SHA256 6b6a6e3a8b4d682660964cc402588ad432d71b97864ba5e7281128ee49ee9e39
MD5 476dbaa959e0020284b16eecbf7e2a93
SHA1 d4c0c530e4f987b0a833b307d0ac27ed43fbac0d
SHA512 2efd0536e40d8cae5436f5846d4097f6a24dbbc41f68cb371dd469d3a8c4771ce03a4023353bdac7b28ba718d8321d1c4668ecd4a66651f6101200f4492f7776
MD5 SHA1 SHA512

Submit Download