9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970

General

Target

9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe
Size

3.1MB
MD5

1315c171c471295c843ab9313658b8a6
SHA1

85ff530634c4ef848d9096dff77390e47960943b
SHA256

9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970
SHA512

7b60ff58a60425b1313cd47f13cebcd60ccb710aba2ca78f2fe3518a4f2493735a442283945f8efbc357c08f62b6617246ef765cf97a0abe3a36089977d93aa6
SSDEEP

49152:yelloiE9H8Djckmbe7B/eklth60pN023qtIlHr0kogPLtFgE31IF1K3J8:yeljcRbexemhPN0qqIo6LtFgC1If+J8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

4536 rundll32.exe
3428 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings cmd.exe

pid	process
4536	rundll32.exe
3428	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.execmd.execontrol.exerundll32.exeRunDll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 5064	2168	9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe	cmd.exe
PID 2168 wrote to memory of 5064	2168	9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe	cmd.exe
PID 2168 wrote to memory of 5064	2168	9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe	cmd.exe
PID 5064 wrote to memory of 4424	5064	cmd.exe	control.exe
PID 5064 wrote to memory of 4424	5064	cmd.exe	control.exe
PID 5064 wrote to memory of 4424	5064	cmd.exe	control.exe
PID 4424 wrote to memory of 4536	4424	control.exe	rundll32.exe
PID 4424 wrote to memory of 4536	4424	control.exe	rundll32.exe
PID 4424 wrote to memory of 4536	4424	control.exe	rundll32.exe
PID 4536 wrote to memory of 200	4536	rundll32.exe	RunDll32.exe
PID 4536 wrote to memory of 200	4536	rundll32.exe	RunDll32.exe
PID 200 wrote to memory of 3428	200	RunDll32.exe	rundll32.exe
PID 200 wrote to memory of 3428	200	RunDll32.exe	rundll32.exe
PID 200 wrote to memory of 3428	200	RunDll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe
"C:\Users\Admin\AppData\Local\Temp\9bdb970050fc2e9e7472add631f16047a46b6dd97f71cabfef851daaae930970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7A793878\jH4FZWk.bAt" "
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",
3⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",
5⤵
- Suspicious use of WriteProcessMemory
PID:200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL",
6⤵
- Loads dropped DLL
PID:3428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL
Filesize
4.1MB

MD5
d5e18b5f783d8142d3b3409656b24cb3

SHA1
d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74

SHA256
44893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262

SHA512
f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7A793878\jH4FZWk.bAt
Filesize
92B

MD5
2f18b38283c4436e789351ac86931cfc

SHA1
19c87c1316d8c48b2ac0cefe800c68f6f83505db

SHA256
6fcf4241edf0418e37c21dece6c63ebbc2e738d67ec8a5981e0efa83f6a0b09f

SHA512
b8e117158f63773e2b09eba2c7a8f5163e07b4e649ea0a1f96e19f5073646eea42d5c264eae756ceba4fce58094e6ddcaa5200eba73aa88ee5228401c8b899fe

Download Submit
\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL
Filesize
4.1MB

MD5
d5e18b5f783d8142d3b3409656b24cb3

SHA1
d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74

SHA256
44893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262

SHA512
f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0

Download Submit
\Users\Admin\AppData\Local\Temp\7z7A793878\S1Es.cPL
Filesize
4.1MB

MD5
d5e18b5f783d8142d3b3409656b24cb3

SHA1
d7e44f49cc2f4e0dceb8b9a59ea2ca28472fca74

SHA256
44893fa8ae248b7b73d2c85196105fc70ea03e6ee05bdd76da99fcda448fe262

SHA512
f4a515fae914efae746d95266ae9f5778164928a8d4b517700d054094aa9a3ac5b3ce493246f5fe987858430d287498f7e5ddeeeef9cad8de7461b230a2cebe0

Download Submit
memory/3428-27-0x0000000004E70000-0x0000000004F87000-memory.dmp

Filesize
1.1MB

Download
memory/3428-26-0x0000000004E70000-0x0000000004F87000-memory.dmp

Filesize
1.1MB

Download
memory/3428-23-0x0000000004E70000-0x0000000004F87000-memory.dmp

Filesize
1.1MB

Download
memory/3428-22-0x0000000005740000-0x0000000005873000-memory.dmp

Filesize
1.2MB

Download
memory/3428-19-0x0000000003590000-0x0000000003596000-memory.dmp

Filesize
24KB

Download
memory/4536-9-0x0000000000BB0000-0x0000000000BB6000-memory.dmp

Filesize
24KB

Download
memory/4536-17-0x0000000004F20000-0x0000000005037000-memory.dmp

Filesize
1.1MB

Download
memory/4536-16-0x0000000004F20000-0x0000000005037000-memory.dmp

Filesize
1.1MB

Download
memory/4536-13-0x0000000004F20000-0x0000000005037000-memory.dmp

Filesize
1.1MB

Download
memory/4536-12-0x0000000004DE0000-0x0000000004F13000-memory.dmp

Filesize
1.2MB

Download
memory/4536-10-0x0000000010000000-0x0000000010418000-memory.dmp

Filesize
4.1MB

Download

Analysis

Sharing