24a4594da23c10c8368275d1f75e95fe5436a46212aaaea94dc9a40f90672ceb

General

Target

5c9d162fe3c5a63ab017b121ec6b0c82.exe
Size

178KB
MD5

5c9d162fe3c5a63ab017b121ec6b0c82
SHA1

e03b693182e19e21c9a1e0f72d85f047b27f5c20
SHA256

24a4594da23c10c8368275d1f75e95fe5436a46212aaaea94dc9a40f90672ceb
SHA512

37e6efa0855f5b2a0957fc0245e71c372ac9f0bf3372edc204492338727788fa0ae3860bc5059f247e8a153e68a5d480af4553b17a853a17f566d0ec12f2f0a7
SSDEEP

3072:8d9xR3G2BZMbBLBaYw0coLujNHOFbA1BnJkM9B6jQxwv8YC5z41Lk:8d93ZBZMbqYgomHOFbA1BnJhB68xvF5B

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dotop.nlp	Erkslfa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dotop.nlp	Erkslfa.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	Erkslfa.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\TKLobby.ico	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\Windows\Erkslfa.exe	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\Erkslfa.exe	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\windows\Dotop.nlp	Erkslfa.exe
File created	C:\Windows\nlp.reg	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\nlp.reg	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\TKLobby.ico	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\Windows\config.ini	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\config.ini	5c9d162fe3c5a63ab017b121ec6b0c82.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellNew\Command = "rundll32.exe appwiz.cpl,NewLinkHere %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214EE-0000-0000-C000-000000000046}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214F9-0000-0000-C000-000000000046}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellNew	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ = "lnkfile"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{00021500-0000-0000-C000-000000000046}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1440	regedit.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2244 wrote to memory of 2864	2244	5c9d162fe3c5a63ab017b121ec6b0c82.exe	28
PID 2864 wrote to memory of 1440	2864	Erkslfa.exe	32
PID 2864 wrote to memory of 1440	2864	Erkslfa.exe	32
PID 2864 wrote to memory of 1440	2864	Erkslfa.exe	32
PID 2864 wrote to memory of 1440	2864	Erkslfa.exe	32

C:\Users\Admin\AppData\Local\Temp\5c9d162fe3c5a63ab017b121ec6b0c82.exe
"C:\Users\Admin\AppData\Local\Temp\5c9d162fe3c5a63ab017b121ec6b0c82.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2244
- C:\windows\Erkslfa.exe
  "C:\windows\Erkslfa.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /s C:\windows\nlp.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Erkslfa.exe

Filesize
178KB

MD5
c5be0c0f188a5fb75928baba0f046655

SHA1
4b531d58d691ede8004f0dc3cc60c5188d0005b5

SHA256
8f8fecdf1c66eb0da8d3e1163247f1880ed285c33afc005e12b5a4985b5b82c4

SHA512
2d2c87a265e7a6ba3e24b26f523fbf23f16a50bf40e45b6779707923380f5b484e5ff19876a791156727b2e5167241cd3c415f8074543a93d42f675415180600

Download Submit
C:\Windows\nlp.reg

Filesize
1KB

MD5
03c8bdd1de2c4b9a1d3e633c2291cabd

SHA1
d263605f8f6eaa1c067b1e0d0ecb9d3acdd056b7

SHA256
fa1425b7727b215c37a93f9664ff23a6d7d00cf51159c3be76a032df1bbbcf2e

SHA512
2fd3524524852d12acace07d7028893c4378c8dfbc9fcf56ea0a093a239335d66afccb122566fe0505daf14d0ff3aecc813a55f177447614460277d04860afb8

Download Submit
C:\windows\config.ini

Filesize
73B

MD5
9181157a5c6e6d271167f056c916e138

SHA1
ca09fd827a63758438098d9068977ceabcf3d301

SHA256
877af9dd2c1aaa07c3fc9780fa0610a677d97d26e5656d15c72715754a7a0376

SHA512
661e185451d0e241445454ce5230f740455987ccc0fb6d4d5df3af40de3d8814add178b9accbcd86bc18f1b8b4755f69d19133f593d215407bb4ad6572a98222

Download Submit
memory/2244-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2864-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2864-37-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing