1ce1d99b845062d171cc2c7e3b44ef2a5d08699debbffca20b3f803be5beecc1

General

Target

04b3695ac593c44e1cb730bcfd824f5e.exe
Size

562KB
MD5

04b3695ac593c44e1cb730bcfd824f5e
SHA1

24c2e786f14c428c9fb4796740e6ddb31c3d1f74
SHA256

1ce1d99b845062d171cc2c7e3b44ef2a5d08699debbffca20b3f803be5beecc1
SHA512

64d40157a66c36b3e996b4925b989c035a4e983d93f26b371d0ae7066242954acfafcc4dff593e50a6797e8e5cbb257cb1432b556783690f7bf3aba0c41b7a49
SSDEEP

12288:oPwMDD1dxDx5SCbpK2h6Ieu96aUT7dxIfLbdi8R+3z2f:kt9jF5JU2h6IlLUTUvdRRaz2f

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2868	DownloadManager.exe

Loads dropped DLL 8 IoCs

pid	Process
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe
2916	04b3695ac593c44e1cb730bcfd824f5e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	DownloadManager.exe
2868	DownloadManager.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2868	2916	04b3695ac593c44e1cb730bcfd824f5e.exe	28
PID 2916 wrote to memory of 2868	2916	04b3695ac593c44e1cb730bcfd824f5e.exe	28
PID 2916 wrote to memory of 2868	2916	04b3695ac593c44e1cb730bcfd824f5e.exe	28
PID 2916 wrote to memory of 2868	2916	04b3695ac593c44e1cb730bcfd824f5e.exe	28

C:\Users\Admin\AppData\Local\Temp\04b3695ac593c44e1cb730bcfd824f5e.exe
"C:\Users\Admin\AppData\Local\Temp\04b3695ac593c44e1cb730bcfd824f5e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\DM_thJaGvOoMm\DownloadManager.exe
  DownloadManager.exe "C:\Users\Admin\AppData\Local\Temp\04b3695ac593c44e1cb730bcfd824f5e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM_thJaGvOoMm\DownloadManager.exe

Filesize
68KB

MD5
9cc247e310d952cfab0b05b74b700e52

SHA1
c633a154421e528e0f9cdb715c836911a85d9ac0

SHA256
090846b2f3d25be4f37332bae004c120dcc691774dc91837d486cb4bfb36064f

SHA512
edefc97c0a56371b301ae57a47d41f5f00d8e0d70046d54335305e244536527b7251f53363653e48ba2425dcc2b0067ad984b6d0a7976e4de1a1959d5b8274ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM_thJaGvOoMm\DownloadManager.exe

Filesize
150KB

MD5
a5986030f1a0a83dbfd07305ba79bd80

SHA1
1402960eaddf38e9e016d07e309fd9f1ef1e1751

SHA256
b0f299ab33900831ae46de55d82f2ec275f734cefc04e17cd520578acdaba563

SHA512
356e2e045e63bf83b46e697983043ccacd7c98f18b2baf0a8ba38f7cecf26abcb46f10ce32c7e661aaec31245b69190f3846c619868bb36197e566613220ee8a

Download Submit
\Users\Admin\AppData\Local\Temp\DM_thJaGvOoMm\DownloadManager.exe

Filesize
14KB

MD5
9cb15cb13a13b22370e1d5d90b950520

SHA1
fbbf42f8e415b5bcd558b899624f30dc9504b12c

SHA256
133548aa9a7eed834e5386843ba7d0d7a5f2d1d58428b2248d39602d6cd629cf

SHA512
2f8551a9d985ee8e810a798888a9844e3be3f98a269b06e02573bd7c520583d38c4558a59c1e464130f98d12f6b2d921b5879a5a126e284a4e92e7a6a9810e1f

Download Submit
\Users\Admin\AppData\Local\Temp\DM_thJaGvOoMm\DownloadManager.exe

Filesize
40KB

MD5
16ea7a3880380ec379379a3b717a3585

SHA1
289a74c72f5f05027b62ac3b833f5860e9c20151

SHA256
a05edbfe8ae063b92e1f8c8360b97a3b51d1f78273294bdaa078f7ed6d10a3d9

SHA512
234185528d918e59fb5ec00321b8588d896d93e1286c6b1a76885ce7b424f5dfe40b879f56534168f5a2d2db7d23ccef6f7c50c8e64fc5f5b8fd4d8d7e29ac74

Download Submit
\Users\Admin\AppData\Local\Temp\nst1382.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
\Users\Admin\AppData\Local\Temp\nst1382.tmp\UserInfo.dll

Filesize
4KB

MD5
031ec9b12afb1fafc9fc397f3b90f29c

SHA1
de26ddfe3ef452f8205bfbd5520a8eff6328619f

SHA256
2dc320488b636b9dce9581a95e5a833a07500622c1a64fc05023ba6482d2a6e1

SHA512
cbebded4e3a87234899e2b67121f898c9060671d25088b7de29bbcbda90a5410dd3afd110417caa6c46ba656e1a863da39127e15c2122fedaa5054f4d43b90a6

Download Submit
\Users\Admin\AppData\Local\Temp\nst1382.tmp\inetc.dll

Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nst1382.tmp\pwgen.dll

Filesize
16KB

MD5
a555472395178ac8c733d90928e05017

SHA1
f44b192d66473f01a6540aaec4b6c9ac4c611d35

SHA256
82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

SHA512
e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

Download Submit
memory/2868-40-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/2868-39-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2868-41-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2868-42-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/2868-43-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/2868-44-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/2868-45-0x0000000021260000-0x0000000021A06000-memory.dmp

Filesize
7.6MB

Download
memory/2868-51-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2868-52-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing