5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc

General

Target

5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe
Size

3.1MB
MD5

1494fe627a9f16f76e85318158e171c7
SHA1

8b51e8a9e90c8b94e758ffa6baf4acdd44bf6a87
SHA256

5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc
SHA512

921e398ffee79e445d553670fd3de907d6f36bf358948e158c4203036aac9b3be4cfc3847cdbfdd10e716b295e71468e1e1f9d00595ba9a0b5ed8ac28c3be86a
SSDEEP

49152:o2LGc6Z6aTi920cjJG27kyczPDzA3gxMw7l1HmRiufrJWNBFiB/X6kdtVvs:FP68a29UjJG20swPLH6WNBUXhFs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
2300	SRadioStation.exe
3900	SRadioStation.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-D3HRV.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-MH6Q7.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-90BHU.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-OFFDE.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-VJFLQ.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-R4205.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-PTLE3.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-3GP5M.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-340EG.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-HC44F.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-O3DIU.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-1144U.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-2TBKA.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-610VA.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-Q8ELE.tmp	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1704	2072	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe	88
PID 2072 wrote to memory of 1704	2072	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe	88
PID 2072 wrote to memory of 1704	2072	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe	88
PID 1704 wrote to memory of 2664	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	92
PID 1704 wrote to memory of 2664	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	92
PID 1704 wrote to memory of 2664	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	92
PID 1704 wrote to memory of 2300	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	94
PID 1704 wrote to memory of 2300	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	94
PID 1704 wrote to memory of 2300	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	94
PID 2664 wrote to memory of 772	2664	net.exe	95
PID 2664 wrote to memory of 772	2664	net.exe	95
PID 2664 wrote to memory of 772	2664	net.exe	95
PID 1704 wrote to memory of 3900	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	96
PID 1704 wrote to memory of 3900	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	96
PID 1704 wrote to memory of 3900	1704	5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp	96

C:\Users\Admin\AppData\Local\Temp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe
"C:\Users\Admin\AppData\Local\Temp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\is-EG7I6.tmp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EG7I6.tmp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp" /SL5="$F0056,2866251,140800,C:\Users\Admin\AppData\Local\Temp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 31
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 31
      4⤵
      PID:772
- - C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
    "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2300
- - C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
    "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
8d6d6569983e31cc14ae973884bebe27

SHA1
987b38200d39b966c3aeacaa38b2218d57df65ed

SHA256
dcb0e2d7bd45b561f20fea258c74ebf9437373d88741db0dafc7f3dcb21fc337

SHA512
6ef0ad954b67ab4096cb0c765b9ae75be52d08c5cd2f51fcb10dafa8e8e32ded6593cae561fbea3b9f80eed064762a3f04d4d1d07858fed562f171005182d7f9

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
8d6d6569983e31cc14ae973884bebe27

SHA1
987b38200d39b966c3aeacaa38b2218d57df65ed

SHA256
dcb0e2d7bd45b561f20fea258c74ebf9437373d88741db0dafc7f3dcb21fc337

SHA512
6ef0ad954b67ab4096cb0c765b9ae75be52d08c5cd2f51fcb10dafa8e8e32ded6593cae561fbea3b9f80eed064762a3f04d4d1d07858fed562f171005182d7f9

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
8d6d6569983e31cc14ae973884bebe27

SHA1
987b38200d39b966c3aeacaa38b2218d57df65ed

SHA256
dcb0e2d7bd45b561f20fea258c74ebf9437373d88741db0dafc7f3dcb21fc337

SHA512
6ef0ad954b67ab4096cb0c765b9ae75be52d08c5cd2f51fcb10dafa8e8e32ded6593cae561fbea3b9f80eed064762a3f04d4d1d07858fed562f171005182d7f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EG7I6.tmp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EG7I6.tmp\5097cfe2a4877e079d235113a759fd44fe5ca510781b214b10ef1e6878d4cfbc.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KKSJQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1704-7-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1704-63-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1704-65-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2072-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2072-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2300-52-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/2300-57-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/2300-56-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/2300-54-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-67-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-88-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-66-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-59-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-70-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-73-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-76-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-79-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-82-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-84-0x0000000000850000-0x00000000008F9000-memory.dmp

Filesize
676KB

Download
memory/3900-83-0x0000000000850000-0x00000000008F9000-memory.dmp

Filesize
676KB

Download
memory/3900-61-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-89-0x0000000000850000-0x00000000008F9000-memory.dmp

Filesize
676KB

Download
memory/3900-92-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-95-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-98-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-101-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-104-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-105-0x0000000000850000-0x00000000008F9000-memory.dmp

Filesize
676KB

Download
memory/3900-106-0x0000000000850000-0x00000000008F9000-memory.dmp

Filesize
676KB

Download
memory/3900-110-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/3900-113-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing