36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d

General

Target

36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
Size

9.9MB
MD5

65770593cc32bd2a9fc11c5d78029872
SHA1

6c03e51e7bc30117d90ef6584745ea8b5cb292a5
SHA256

36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d
SHA512

17686f386cbe62b4059bc69f5384e2dde95200a7f904307c50ea92d76b27de3b2ae866487a568ed908e4b9bede49737c3965838ac1ab3598011815ae14502b80
SSDEEP

196608:iTew5WbQLOZchS2wzdIW1bdyFTvgoF0baTXaTx5b4j7N24/bofB:QeQdAdzbA+I0mTqNx4jdof

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\X:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\Z:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\E:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\I:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\N:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\U:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\H:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\L:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\T:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\J:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\M:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\O:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\R:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\S:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\W:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\Y:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\G:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\K:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\P:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
File opened (read-only)	\??\Q:	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91
PID 804 wrote to memory of 3820	804	36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe	91

C:\Users\Admin\AppData\Local\Temp\36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
"C:\Users\Admin\AppData\Local\Temp\36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe
  "C:\Users\Admin\AppData\Local\Temp\36a31b4e1042622d5f2e4124bbb751e5aac4329f521a99fb55445a5fc4ebd57d.exe"
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-15-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/804-11-0x0000000010000000-0x000000001090F000-memory.dmp

Filesize
9.1MB

Download
memory/804-0-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download
memory/804-4-0x0000000010000000-0x000000001090F000-memory.dmp

Filesize
9.1MB

Download
memory/804-1-0x0000000002DD0000-0x0000000002DD3000-memory.dmp

Filesize
12KB

Download
memory/804-2-0x0000000010000000-0x000000001090F000-memory.dmp

Filesize
9.1MB

Download
memory/804-9-0x0000000010000000-0x000000001090F000-memory.dmp

Filesize
9.1MB

Download
memory/3820-39-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3820-19-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-16-0x0000000003A30000-0x0000000003A31000-memory.dmp

Filesize
4KB

Download
memory/3820-12-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-13-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3820-18-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-17-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-10-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/3820-21-0x0000000003A20000-0x0000000003A21000-memory.dmp

Filesize
4KB

Download
memory/3820-7-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-22-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/3820-14-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-24-0x0000000004D00000-0x0000000004D03000-memory.dmp

Filesize
12KB

Download
memory/3820-25-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/3820-27-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/3820-28-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3820-29-0x0000000006350000-0x0000000006407000-memory.dmp

Filesize
732KB

Download
memory/3820-31-0x00000000039D0000-0x00000000039D1000-memory.dmp

Filesize
4KB

Download
memory/3820-33-0x0000000003A40000-0x0000000003A41000-memory.dmp

Filesize
4KB

Download
memory/3820-34-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-35-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/3820-36-0x0000000001060000-0x0000000001305000-memory.dmp

Filesize
2.6MB

Download
memory/3820-37-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/3820-20-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads