550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22

General

Target

550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
Size

11.3MB
MD5

9fa5cf1566f5804b09c71cfd2a5c8520
SHA1

470b477f94d6ede702f7312b88b16ae23d728da4
SHA256

550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22
SHA512

88b55f1273a36ef79500d2cca92a90c1df765537486b7f12b6dddc2325f8161c6b25c57765fd28f21c739f52de9cb8ebec1c70fd693f4789500fe1366c01eabb
SSDEEP

196608:vyQ5L6m1GjKFKWUGNEoiN/A4sXru7JoE4++HHPXCMMUzoUG55Y:Gm1Gj3pGNv7i8++n6/7UG52

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\F:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\E:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\H:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\K:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\L:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\N:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\Y:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\Z:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\G:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\O:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\P:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\R:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\T:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\W:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\A:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\B:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\I:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\J:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\V:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\M:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\Q:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\S:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
File opened (read-only)	\??\X:	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
3052	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3052	4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe	84
PID 4428 wrote to memory of 3052	4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe	84
PID 4428 wrote to memory of 3052	4428	550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe	84

C:\Users\Admin\AppData\Local\Temp\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
"C:\Users\Admin\AppData\Local\Temp\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428
- F:\ÂÞÉ²Î¢±ä\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
  F:\ÂÞÉ²Î¢±ä\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\276d89daefdf8ef7fe6eb84ffb73bbed.tmp

Filesize
11B

MD5
54ed5b004f2898408a1a47ec6c5afc7f

SHA1
3439f1f036937f0393ac9281e98b5b3b748573c6

SHA256
82fc5970603dda1c8c0fe2a9bb7776b20dc0b544d7ffa1300168b0ec149483c3

SHA512
dec1f84188ec3378621034682d84f5b4e1f50517d2630bd351a0d24e4b9c3ea42fa925d84a7d6fd8fc31594f288fdf57c115d6a8aa052ea604e2f86c61118dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a13acaf3e26a2cb932cf815a581d3df.ini

Filesize
429B

MD5
7ef921aa1bc3ffa6b077f808a7533a3e

SHA1
41b289031dd45391d7ad939b9e2e4a612d57921a

SHA256
596b77cf9f336b9aeb31f47c6002ff4e8dfbe93d1143bd7f942a3061e22e2966

SHA512
bfdc113978e8b081215a80f626368303fa51d259fa79809732f74610d17f64afcf5dd1373f4e58b5a860e37a96ca823c690cb8da0e21630ca2875a993755bdc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a13acaf3e26a2cb932cf815a581d3df.ini

Filesize
10KB

MD5
ec23c7ddb6154932869944ac62928ee3

SHA1
7ad916bd2bd76ec134b71635f8bd604f797009b3

SHA256
b2fdbfa1875a7db4e1b8cbf7d5c7d35aab615b9fcc3fe85fbf65250e9fceb1bf

SHA512
79da6cf5ee6a0994ca99f7e0d9bfda077184eb3c5762373f4696c3579491d1adcb69eee13103d19be94a496dcc712e5be0d389ba9a24e2b4eb807ccc32e21f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.tmp

Filesize
102B

MD5
a2989cd71cf28adbb0b8c00cffb747e6

SHA1
29af356a0978e9ac170ccd3adf7dde48d7b48d51

SHA256
a9524e96ea3cf840887be72eed4ae54551bb51ed24a98ade14b351999e966418

SHA512
7c7e2df1080f48b9a154ea338de440f506f20f8d86ec302987dbd1637eded92020c12dbf7c131180a82eaff56c93ca42d40101eeb55ee78129352bfcd75a8d03

Download Submit
F:\ÂÞÉ²Î¢±ä\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe

Filesize
11.3MB

MD5
9fa5cf1566f5804b09c71cfd2a5c8520

SHA1
470b477f94d6ede702f7312b88b16ae23d728da4

SHA256
550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22

SHA512
88b55f1273a36ef79500d2cca92a90c1df765537486b7f12b6dddc2325f8161c6b25c57765fd28f21c739f52de9cb8ebec1c70fd693f4789500fe1366c01eabb

Download Submit
F:\ÂÞÉ²Î¢±ä\550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22.exe

Filesize
11.3MB

MD5
9fa5cf1566f5804b09c71cfd2a5c8520

SHA1
470b477f94d6ede702f7312b88b16ae23d728da4

SHA256
550bb15725153e19dd8ac84a1e8d2fb3e2b9261842dba94a680b238e2bcedd22

SHA512
88b55f1273a36ef79500d2cca92a90c1df765537486b7f12b6dddc2325f8161c6b25c57765fd28f21c739f52de9cb8ebec1c70fd693f4789500fe1366c01eabb

Download Submit
memory/3052-160-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download
memory/3052-9-0x0000000000C90000-0x0000000000C93000-memory.dmp

Filesize
12KB

Download
memory/3052-8-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download
memory/3052-161-0x0000000000C90000-0x0000000000C93000-memory.dmp

Filesize
12KB

Download
memory/3052-164-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download
memory/3052-171-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download
memory/4428-11-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download
memory/4428-14-0x0000000000CD0000-0x0000000000CD3000-memory.dmp

Filesize
12KB

Download
memory/4428-1-0x0000000000CD0000-0x0000000000CD3000-memory.dmp

Filesize
12KB

Download
memory/4428-0-0x0000000000400000-0x0000000000C35000-memory.dmp

Filesize
8.2MB

Download

Analysis

Sharing