7d4c7c9c88715777c8d8015f32a9bd78ca5fdc11a7dcc0b122c8f4e3eef86b9e

General

Target

63249c576edc9ea6ab9db69c6a246a68.exe
Size

4.0MB
MD5

63249c576edc9ea6ab9db69c6a246a68
SHA1

a9d9098cea50db4ed7b7dc50e4c3aa01b854de85
SHA256

7d4c7c9c88715777c8d8015f32a9bd78ca5fdc11a7dcc0b122c8f4e3eef86b9e
SHA512

cd815c54acbe518eab6f04b4669137d2796c6bccc99fdf33942c98b716f67fc98bfd84b7ae40d18a3148bbc9088f0d09cb8f9185dfc307fd2427281aeefdcc69
SSDEEP

98304:PX4UvYQuEW9HKuoaTn9BkyD4qlrobltettyryazx14:v/YkWlKu99Bky9oblAtt4ya0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2520	63249c576edc9ea6ab9db69c6a246a68.tmp
2780	Explicabo.exe

Loads dropped DLL 4 IoCs

pid	Process
760	63249c576edc9ea6ab9db69c6a246a68.exe
2520	63249c576edc9ea6ab9db69c6a246a68.tmp
2520	63249c576edc9ea6ab9db69c6a246a68.tmp
2780	Explicabo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Aut\occaecati\is-G9SRH.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-S01QR.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\et\is-E78FR.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\occaecati\is-0G8OC.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\occaecati\is-I54NE.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\occaecati\is-661QJ.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File opened for modification	C:\Program Files (x86)\Aut\sqlite3.dll	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-FPR51.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-J5NDF.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\et\is-NLVLT.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\occaecati\is-MNRFC.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-PM526.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File opened for modification	C:\Program Files (x86)\Aut\unins000.dat	63249c576edc9ea6ab9db69c6a246a68.tmp
File opened for modification	C:\Program Files (x86)\Aut\Explicabo.exe	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-MLRG3.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-FECKN.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\unins000.dat	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-PB6QE.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp
File created	C:\Program Files (x86)\Aut\is-E87KP.tmp	63249c576edc9ea6ab9db69c6a246a68.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2520	63249c576edc9ea6ab9db69c6a246a68.tmp
2520	63249c576edc9ea6ab9db69c6a246a68.tmp
2780	Explicabo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	63249c576edc9ea6ab9db69c6a246a68.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 760 wrote to memory of 2520	760	63249c576edc9ea6ab9db69c6a246a68.exe	20
PID 2520 wrote to memory of 2780	2520	63249c576edc9ea6ab9db69c6a246a68.tmp	29
PID 2520 wrote to memory of 2780	2520	63249c576edc9ea6ab9db69c6a246a68.tmp	29
PID 2520 wrote to memory of 2780	2520	63249c576edc9ea6ab9db69c6a246a68.tmp	29
PID 2520 wrote to memory of 2780	2520	63249c576edc9ea6ab9db69c6a246a68.tmp	29

C:\Users\Admin\AppData\Local\Temp\63249c576edc9ea6ab9db69c6a246a68.exe
"C:\Users\Admin\AppData\Local\Temp\63249c576edc9ea6ab9db69c6a246a68.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\is-GSA6H.tmp\63249c576edc9ea6ab9db69c6a246a68.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GSA6H.tmp\63249c576edc9ea6ab9db69c6a246a68.tmp" /SL5="$400EA,3523396,721408,C:\Users\Admin\AppData\Local\Temp\63249c576edc9ea6ab9db69c6a246a68.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Program Files (x86)\Aut\Explicabo.exe
    "C:\Program Files (x86)\Aut/\Explicabo.exe" f16782cc59e76d9c5efe60e3c61e348b
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-GSA6H.tmp\63249c576edc9ea6ab9db69c6a246a68.tmp

Filesize
382KB

MD5
87a3b02d203d1c69ef3b4f9a50f848ce

SHA1
a621ca18c711e03f4c8f1deb06d7aa07c1b3d1c0

SHA256
1aad33314da6b332f3c71df86d61216bf5cb4331c53b4894ef6d48059bf4effe

SHA512
6c777ad8be8fb29d7a0813442b0b7b6d99fc9f1c14a592535f4208d0b0d49866d54801bdc47a81190875c142b4e35252453a141c30ccd0bf8bd72b764350f5ab

Download Submit
memory/760-54-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/760-1-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2520-55-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2520-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2520-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2780-52-0x0000000000400000-0x00000000014F6000-memory.dmp

Filesize
17.0MB

Download
memory/2780-53-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2780-57-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2780-56-0x0000000000400000-0x00000000014F6000-memory.dmp

Filesize
17.0MB

Download
memory/2780-51-0x0000000000400000-0x00000000014F6000-memory.dmp

Filesize
17.0MB

Download
memory/2780-60-0x0000000000400000-0x00000000014F6000-memory.dmp

Filesize
17.0MB

Download
memory/2780-77-0x0000000000400000-0x00000000014F6000-memory.dmp

Filesize
17.0MB

Download

Analysis

Sharing