0446c8d5b960c5bf03d0bb05e17be622c3e636c3ca3aa62646fb457d5dd4878f

General

Target

fee7fb3d6d82af128426a03b0e3dadc4.exe
Size

4.8MB
MD5

fee7fb3d6d82af128426a03b0e3dadc4
SHA1

4f3e5e2ed3e00d231b2808dd81d6295721bd5bdb
SHA256

0446c8d5b960c5bf03d0bb05e17be622c3e636c3ca3aa62646fb457d5dd4878f
SHA512

abc2fbf18243a0c3630bf60e70420c0a17c403d489d4a5ab75b1b1517275daf3a49f40830881d30e45e3ff5438785945192f67450da244b35b5fc18311547eb6
SSDEEP

98304:PX4pTX9LWbuKeaQEHsfd1/EVP0yWi8QN0yazx14:vyD9LWqKr/qcVl7iya0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp
1868	Ullam.exe

Loads dropped DLL 3 IoCs

pid	Process
2464	fee7fb3d6d82af128426a03b0e3dadc4.exe
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Libero\in\is-1J4GB.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File opened for modification	C:\Program Files (x86)\Libero\in\Ullam.exe	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\amet\is-J8KK2.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\expedita\is-H879P.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\in\is-32S2O.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\sit\is-K8AS8.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File opened for modification	C:\Program Files (x86)\Libero\in\sqlite3.dll	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\in\is-P1AND.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\in\is-9CMPT.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\expedita\is-2072A.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File opened for modification	C:\Program Files (x86)\Libero\unins000.dat	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\unins000.dat	fee7fb3d6d82af128426a03b0e3dadc4.tmp
File created	C:\Program Files (x86)\Libero\is-U3I1S.tmp	fee7fb3d6d82af128426a03b0e3dadc4.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2464 wrote to memory of 2388	2464	fee7fb3d6d82af128426a03b0e3dadc4.exe	28
PID 2388 wrote to memory of 1868	2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp	29
PID 2388 wrote to memory of 1868	2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp	29
PID 2388 wrote to memory of 1868	2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp	29
PID 2388 wrote to memory of 1868	2388	fee7fb3d6d82af128426a03b0e3dadc4.tmp	29

C:\Users\Admin\AppData\Local\Temp\fee7fb3d6d82af128426a03b0e3dadc4.exe
"C:\Users\Admin\AppData\Local\Temp\fee7fb3d6d82af128426a03b0e3dadc4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\is-GMP93.tmp\fee7fb3d6d82af128426a03b0e3dadc4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GMP93.tmp\fee7fb3d6d82af128426a03b0e3dadc4.tmp" /SL5="$400F4,4328777,721408,C:\Users\Admin\AppData\Local\Temp\fee7fb3d6d82af128426a03b0e3dadc4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\Libero\in\Ullam.exe
    "C:\Program Files (x86)\Libero/\in\Ullam.exe" e2c27623e8b51d0c2d45828ab8fc2ddb
    3⤵
    - Executes dropped EXE
    PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Libero\in\Ullam.exe

Filesize
4.6MB

MD5
685a78b3205744cf11875a8304ac9307

SHA1
790fc12f1bba62e37acd2eaa9ffe89d42a545b44

SHA256
ef8bc9bf76a5af436adcf963cb8f621f52381c61d75851f4c01d9f93b34ba576

SHA512
62178bafdc587a63d309469bd38e03df68db52aef280e040724b10c3347b6847d90d7d57d7c8edf28dabfccdbd3c3899eb6906ae93ae0688b74f8aa760cfba7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GMP93.tmp\fee7fb3d6d82af128426a03b0e3dadc4.tmp

Filesize
2.4MB

MD5
3fddfbaa9d029821152e746edbabf7ce

SHA1
703690b3a2377047f6755e9b5274d608791b8062

SHA256
787cef456bd60075199c04ac38dd5e65291bd3a930b132538889e4dafb76fa1a

SHA512
fd50e763c6523022f1be02a6a690d2a2dec4e9a73c941314b4a810bbd7605d4058c5c49c53dcbdd8fde5e6c4d2c78fcec52b5bca087cbf552bc1ce90819c4903

Download Submit
\Users\Admin\AppData\Local\Temp\is-0M76M.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-GMP93.tmp\fee7fb3d6d82af128426a03b0e3dadc4.tmp

Filesize
1.5MB

MD5
55b5ff8ea1df4831109b48314d8e3a10

SHA1
c8a784797973208b4138c7aede376d4f75beb98f

SHA256
3b2ae3acc4f92362e9e3f191db076efed0b52324935ca778932a8560679c0e71

SHA512
86c7ee2f89e1bc2f9ad18c8bf3fa1e65c1cc622eb807373102b8a65c4169bc2c02466efad3862ed57c5c5e81da39c920253af78165ade413ff3e12530ce110ad

Download Submit
memory/1868-39-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1868-37-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/1868-38-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/1868-42-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/1868-52-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/1868-79-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/1868-82-0x0000000000400000-0x00000000016A5000-memory.dmp

Filesize
18.6MB

Download
memory/2388-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2388-41-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2388-45-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2464-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2464-40-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing