a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03

General

Target

a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe
Size

3.0MB
MD5

0f4254758c30f9a60868c6de3426c915
SHA1

d4567e62437d041a815a3baba406a2abeee3d603
SHA256

a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03
SHA512

337706f5a8a81e8027603edaa901d5444eeefa26ab68b9932f044aa05c91b206510ba4a2ee7fca755243ac00353c4afe7ef8c95d1ba400f16593c83e5ca33d9e
SSDEEP

49152:k2SSzl4ldpEZ7Na4bE2fxr8WGS9UbeL1fI5jhwA1YbGtJ1kr1e2PdTwVfYVXD1Ls:pSSzlSpK4258YIPwad31wLmYxW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
2552	LAudioConverter.exe
1808	LAudioConverter.exe

Loads dropped DLL 3 IoCs

pid	Process
3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LAudioConverter\unins000.dat	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-PK9J9.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-9999V.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-G27M4.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\XML\Styles\is-N200C.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File opened for modification	C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-3OVVG.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-947BR.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\XML\Styles\is-H9SQS.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-65EGS.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-FNA90.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-6S55B.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-2J315.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-0B8C4.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-73IKM.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\is-7I73R.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File created	C:\Program Files (x86)\LAudioConverter\XML\Styles\is-T5S2O.tmp	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
File opened for modification	C:\Program Files (x86)\LAudioConverter\unins000.dat	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3176	5040	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe	86
PID 5040 wrote to memory of 3176	5040	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe	86
PID 5040 wrote to memory of 3176	5040	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe	86
PID 3176 wrote to memory of 3900	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	89
PID 3176 wrote to memory of 3900	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	89
PID 3176 wrote to memory of 3900	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	89
PID 3176 wrote to memory of 2552	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	91
PID 3176 wrote to memory of 2552	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	91
PID 3176 wrote to memory of 2552	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	91
PID 3176 wrote to memory of 1808	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	93
PID 3176 wrote to memory of 1808	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	93
PID 3176 wrote to memory of 1808	3176	a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp	93

C:\Users\Admin\AppData\Local\Temp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe
"C:\Users\Admin\AppData\Local\Temp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\is-FNKMK.tmp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FNKMK.tmp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp" /SL5="$401EA,2928213,68096,C:\Users\Admin\AppData\Local\Temp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "LAC1031-1"
    3⤵
    PID:3900
- - C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe
    "C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2552
- - C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe
    "C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe

Filesize
2.0MB

MD5
b1dfce4a916e451f68ed2d3d7151e266

SHA1
ce4d084765812ab56f03cd69d8f47ba0cd309b09

SHA256
455835817ba9c9b16ff66383f0180a7104d9a98f908ce0ab842b20ef6da3c627

SHA512
2898311cedfc74a0f53c31218c71589786eb2300ec982359698d7bd325ab7e29308a1e9ea2a8c8ac5c608ed93f527267160573d7d1e3955a4af882b66820b8d4

Download Submit
C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe

Filesize
2.0MB

MD5
b1dfce4a916e451f68ed2d3d7151e266

SHA1
ce4d084765812ab56f03cd69d8f47ba0cd309b09

SHA256
455835817ba9c9b16ff66383f0180a7104d9a98f908ce0ab842b20ef6da3c627

SHA512
2898311cedfc74a0f53c31218c71589786eb2300ec982359698d7bd325ab7e29308a1e9ea2a8c8ac5c608ed93f527267160573d7d1e3955a4af882b66820b8d4

Download Submit
C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe

Filesize
2.0MB

MD5
b1dfce4a916e451f68ed2d3d7151e266

SHA1
ce4d084765812ab56f03cd69d8f47ba0cd309b09

SHA256
455835817ba9c9b16ff66383f0180a7104d9a98f908ce0ab842b20ef6da3c627

SHA512
2898311cedfc74a0f53c31218c71589786eb2300ec982359698d7bd325ab7e29308a1e9ea2a8c8ac5c608ed93f527267160573d7d1e3955a4af882b66820b8d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FNKMK.tmp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp

Filesize
694KB

MD5
76a0e9b1e8b487085d3eedf0ba8d1062

SHA1
d353c3c584127c0db9d7d0b04d776be5920dd0bb

SHA256
25a8b697629d47fdf66c7815130fb119c9f2b6aabaf17a4851f059a565b71258

SHA512
3c7e0ce15f515c87a7b228831fc01c578d69070abef88af526aeefe5493561e4ab94372e2bffff5016407f13185f733078f6893a7ed9117369e179ba140ea020

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FNKMK.tmp\a18fce2e89cd87c9632f64384516af77ecdfe29a019960ad061064bd9bd65b03.tmp

Filesize
694KB

MD5
76a0e9b1e8b487085d3eedf0ba8d1062

SHA1
d353c3c584127c0db9d7d0b04d776be5920dd0bb

SHA256
25a8b697629d47fdf66c7815130fb119c9f2b6aabaf17a4851f059a565b71258

SHA512
3c7e0ce15f515c87a7b228831fc01c578d69070abef88af526aeefe5493561e4ab94372e2bffff5016407f13185f733078f6893a7ed9117369e179ba140ea020

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P3990.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P3990.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P3990.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/1808-93-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-100-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-118-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-115-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-111-0x00000000008F0000-0x0000000000999000-memory.dmp

Filesize
676KB

Download
memory/1808-110-0x00000000008F0000-0x0000000000999000-memory.dmp

Filesize
676KB

Download
memory/1808-66-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-109-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-106-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-103-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-71-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-72-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-75-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-78-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-81-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-84-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-87-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-89-0x00000000008F0000-0x0000000000999000-memory.dmp

Filesize
676KB

Download
memory/1808-88-0x00000000008F0000-0x0000000000999000-memory.dmp

Filesize
676KB

Download
memory/1808-97-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/1808-94-0x00000000008F0000-0x0000000000999000-memory.dmp

Filesize
676KB

Download
memory/2552-58-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/2552-63-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/2552-62-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/2552-60-0x0000000000400000-0x000000000060B000-memory.dmp

Filesize
2.0MB

Download
memory/3176-70-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3176-68-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3176-7-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/5040-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5040-67-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing