fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a

General

Target

fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
Size

10.7MB
MD5

60e1f2afcbad42a1f6cc30ac53e1b402
SHA1

70a467a9ea249802877373ed55e02dc8cef89ebe
SHA256

fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a
SHA512

018582e99dd38fc2b6c96755dc28b41a769087b6969ecf73c127f1e444389c223b5f5fe35c92570ef2838ff7087b70ee5a9f122e0e5998820efdb33c773f375a
SSDEEP

196608:AJ+bDQ2CSNH2GUHGQbn1dFfNRCo+0Rym3f3Zy7WZGan7e1fTEw/:AJ+b0SRjoxz1KEy+pyqF79U

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 2384	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	91
PID 3772 wrote to memory of 2384	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	91
PID 3772 wrote to memory of 2384	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	91
PID 3772 wrote to memory of 816	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	92
PID 3772 wrote to memory of 816	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	92
PID 3772 wrote to memory of 816	3772	fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe	92

C:\Users\Admin\AppData\Local\Temp\fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe
"C:\Users\Admin\AppData\Local\Temp\fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exe"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8aa6f2d271091f3435d3e5096b0c4346.ini

Filesize
1KB

MD5
8181461e4d56fa2810371e6ac62d4c43

SHA1
dbe1afab4f0add1e3e95d52de0d76f3735313520

SHA256
a5108ad97f3d9cfa21ffb0d6c0cf84de09406cf075675373e5baba1da0ae9680

SHA512
002555d73fc3a7a0e23cfe6bc26aa8d7757a8544782a03f2b360f5ab6ddafd64e7a7779100b98fad7dc9eb138942818226cb648b19668152edfc3ed4d5d77b87

Download Submit
C:\Users\Admin\AppData\Local\Temp\8aa6f2d271091f3435d3e5096b0c4346A.ini

Filesize
1KB

MD5
ec4332a79e7bcc29cb2c09048b887737

SHA1
f0674bb8ad19ba876e12298adab0e931eaaa9471

SHA256
ccc01f8d40220933ca6a669758bb766e4810af66a0ef8644d856acbbac7ee8f7

SHA512
b1af59a3c75e0e650f41d71b6e320ade3c2c9fcd6aa1b463b4bc69d6fac03c8875921a8f866e6e65ab9ef09e89aa01192ef911392b2269bb9ade209f19689c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe2cb3df7a8cfbe1f31c21468fdd43b1e10e8474ac0ead9edd86dc921c6d5e0a.exepack.tmp

Filesize
2KB

MD5
20e5d17f25e8bf4d630dd356bcc19b3c

SHA1
0547438f85f050effd5c3da7a2d0ca5228cf1600

SHA256
11164b8de9c25456d54ad0449cee3b982572f4271f984d92235b4ad2763258a9

SHA512
82ef517c2af5c5125004c26ce51d3425d014e27fefe703e0ad759a5d85bef5a60459d280595c10cf2704231ea52bb25f4aecc6fde7a9f1cb5105c781cd9b7426

Download Submit
memory/3772-0-0x0000000000400000-0x0000000001CB4000-memory.dmp

Filesize
24.7MB

Download
memory/3772-1-0x0000000001E50000-0x0000000001E53000-memory.dmp

Filesize
12KB

Download
memory/3772-2-0x0000000000400000-0x0000000001CB4000-memory.dmp

Filesize
24.7MB

Download
memory/3772-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/3772-335-0x0000000000400000-0x0000000001CB4000-memory.dmp

Filesize
24.7MB

Download
memory/3772-339-0x0000000001E50000-0x0000000001E53000-memory.dmp

Filesize
12KB

Download
memory/3772-340-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing