c617de383949cca847ee6a7f63ab06df92a89044977a58876207153390b71a9b

General

Target

04c744043deba1b1bc7a745cd55b92bb.exe
Size

139KB
MD5

04c744043deba1b1bc7a745cd55b92bb
SHA1

c5c93e97595709c30c49124055f0abdd6365233d
SHA256

c617de383949cca847ee6a7f63ab06df92a89044977a58876207153390b71a9b
SHA512

d5bbf791baf402439003bb1fab404078e7d03ebdaecada46db25b72b353468b68207b3ad7f5823ebcbbb89347c1c2993e582b1bf53681db0122f0028e850732d
SSDEEP

1536:/QUnj1MSfNvyrfFt1D4f6EjXTKRZmpqhVQsHQ2I5PVUrKfzabQdUE4++nW:PnRT1MQLjXTI5w2MNz+E4BW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	ssvchost.exe

Executes dropped EXE 7 IoCs

pid	Process
4220	ThePwnerv1.0.exe
4604	TeHPwner.exe
624	Server.exe
2248	PT1.exe
3824	keylogsetup.exe
3740	ssvchost.exe
3504	msvchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3824	keylogsetup.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regm64.dll	keylogsetup.exe
File created	C:\Windows\SysWOW64\msvchost.exe	keylogsetup.exe
File opened for modification	C:\Windows\SysWOW64\rmnl.dll	msvchost.exe
File opened for modification	C:\Windows\SysWOW64\Server.exe	04c744043deba1b1bc7a745cd55b92bb.exe
File opened for modification	C:\Windows\SysWOW64\PT1.exe	04c744043deba1b1bc7a745cd55b92bb.exe
File opened for modification	C:\Windows\SysWOW64\keylogsetup.exe	04c744043deba1b1bc7a745cd55b92bb.exe
File created	C:\Windows\SysWOW64\ssvchost.exe	keylogsetup.exe
File opened for modification	C:\Windows\SysWOW64\ThePwnerv1.0.exe	04c744043deba1b1bc7a745cd55b92bb.exe
File opened for modification	C:\Windows\SysWOW64\TeHPwner.exe	04c744043deba1b1bc7a745cd55b92bb.exe
File opened for modification	C:\Windows\SysWOW64\msvchost.exe	keylogsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process
4128	4604	WerFault.exe
4568	624	WerFault.exe
2196	3504	WerFault.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	PT1.exe
2248	PT1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4436	04c744043deba1b1bc7a745cd55b92bb.exe
4220	ThePwnerv1.0.exe
2248	PT1.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4220	4436	04c744043deba1b1bc7a745cd55b92bb.exe	22
PID 4436 wrote to memory of 4220	4436	04c744043deba1b1bc7a745cd55b92bb.exe	22
PID 4436 wrote to memory of 4220	4436	04c744043deba1b1bc7a745cd55b92bb.exe	22
PID 4436 wrote to memory of 4604	4436	04c744043deba1b1bc7a745cd55b92bb.exe	29
PID 4436 wrote to memory of 4604	4436	04c744043deba1b1bc7a745cd55b92bb.exe	29
PID 4436 wrote to memory of 4604	4436	04c744043deba1b1bc7a745cd55b92bb.exe	29
PID 4436 wrote to memory of 624	4436	04c744043deba1b1bc7a745cd55b92bb.exe	46
PID 4436 wrote to memory of 624	4436	04c744043deba1b1bc7a745cd55b92bb.exe	46
PID 4436 wrote to memory of 624	4436	04c744043deba1b1bc7a745cd55b92bb.exe	46
PID 4436 wrote to memory of 2248	4436	04c744043deba1b1bc7a745cd55b92bb.exe	45
PID 4436 wrote to memory of 2248	4436	04c744043deba1b1bc7a745cd55b92bb.exe	45
PID 4436 wrote to memory of 2248	4436	04c744043deba1b1bc7a745cd55b92bb.exe	45
PID 4436 wrote to memory of 3824	4436	04c744043deba1b1bc7a745cd55b92bb.exe	44
PID 4436 wrote to memory of 3824	4436	04c744043deba1b1bc7a745cd55b92bb.exe	44
PID 4436 wrote to memory of 3824	4436	04c744043deba1b1bc7a745cd55b92bb.exe	44
PID 3824 wrote to memory of 3740	3824	keylogsetup.exe	43
PID 3824 wrote to memory of 3740	3824	keylogsetup.exe	43
PID 3824 wrote to memory of 3740	3824	keylogsetup.exe	43
PID 3740 wrote to memory of 3504	3740	ssvchost.exe	42
PID 3740 wrote to memory of 3504	3740	ssvchost.exe	42
PID 3740 wrote to memory of 3504	3740	ssvchost.exe	42

C:\Users\Admin\AppData\Local\Temp\04c744043deba1b1bc7a745cd55b92bb.exe
"C:\Users\Admin\AppData\Local\Temp\04c744043deba1b1bc7a745cd55b92bb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\ThePwnerv1.0.exe
  C:\Windows\system32\ThePwnerv1.0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4220
- C:\Windows\SysWOW64\TeHPwner.exe
  C:\Windows\system32\TeHPwner.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\SysWOW64\keylogsetup.exe
  C:\Windows\system32\keylogsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3824
- C:\Windows\SysWOW64\PT1.exe
  C:\Windows\system32\PT1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2248
- C:\Windows\SysWOW64\Server.exe
  C:\Windows\system32\Server.exe
  2⤵
  - Executes dropped EXE
  PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4604 -ip 4604
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 492
1⤵
- Program crash
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 624 -ip 624
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 264
1⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 528
1⤵
- Program crash
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3504 -ip 3504
1⤵
PID:4736

C:\Windows\SysWOW64\msvchost.exe
"C:\Windows\system32\msvchost.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3504

C:\Windows\SysWOW64\ssvchost.exe
"C:\Windows\system32\ssvchost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\PT1.exe

Filesize
20KB

MD5
9b6d4a4582bdcd2e72c4afb378eb2429

SHA1
664916c4fa27b227166509c1daf3223200c6449c

SHA256
089cc8b2c647d582dcb41c191269a2d1e2efe12765b5f3f19cee5059b99f7865

SHA512
366986debda38a6b115ff902779f2b10226634c1f97d992dd8aadb423d83a464718358e0be0fd7eb957a0ed9af64c3ae57a9bdc79a075ed700db72f4014126a2

Download Submit
C:\Windows\SysWOW64\Server.exe

Filesize
40KB

MD5
daa792c3dcbf64b00d6ff759cebf3784

SHA1
18b42ff8e0c1486f74aecf97cd221afc8a1fac6d

SHA256
74881b74e5fab1fce9ccb1b4be3e8f1ef1c322ed43567477339edb22a858d965

SHA512
88716ba2bdd51d143d3f082ded8e3bf95b0f28e3cd08d40619f7a3f426f1b4c49eaf64efa2160bd378b793aacae1106a1993a60a333a631c153d96a286e7cbe6

Download Submit
C:\Windows\SysWOW64\TeHPwner.exe

Filesize
10KB

MD5
6b4b37a6e51f869573c1784c25c523a3

SHA1
65a03b11d79756c8ee24f54f46fc448b7e88ab5c

SHA256
368d50304cdaa6be63372e04b0767f916422046958d90b9b2dbd5e51661b4c3c

SHA512
822e719e86f5ab460b8d2351b08b5e67b8f63d5db4d4fa77bd781db826d12d434c52284e978839a1e8b4d0afc723d8307544c05af5481cfff7dc6936611db654

Download Submit
C:\Windows\SysWOW64\ThePwnerv1.0.exe

Filesize
28KB

MD5
593f879fd0eab835e74a3d33969af8a9

SHA1
4f670da255fd4f36e6d725de3d394312ea8b32fa

SHA256
ea8058f606c3793e4faeaca2809368016db6c385ffb3fb79245442488f748403

SHA512
cab15d076a1ef0b2fc9c330a7a6503db7dcfa56dca95f4b97fb9bb74d7bf110443dcc8c6cf350bbc85f207f6dde9d2a324afa18742ee577d7c268b2e3ebe2807

Download Submit
C:\Windows\SysWOW64\keylogsetup.exe

Filesize
12KB

MD5
779c971842427d079914542dc84ddfed

SHA1
2e6583e72e84ba820a8ff737b97582d9b31cf4ac

SHA256
e85beb75576d308374bd1ebdfd3329d778dec35e72861427b80d77e19acfa10a

SHA512
acd5d2b550d7c5b4a85235f5f89637607501d1b31a563c4d0ec3c720cc049b1189fc0b95239a369ced80b5730163c914a797a8b7dc9411bc1c95aaac094e0f73

Download Submit
C:\Windows\SysWOW64\regm64.dll

Filesize
12KB

MD5
618ba27f0502751f408b211f61747827

SHA1
c78868c7b629d2e5d4f447099c9726379b6d421d

SHA256
5c5b2b741b4a7a152f9750e36c61fab1f65ef41955013db8aa487a2ab29b6eb6

SHA512
de6454a04c43c4d0d7f6604b9c0e61eea5fa88b9c15253817b7823b9e3446778331d25ca005625b69bf1f1cf01abe6b89dcdb752d6e179cb59be31f0439fe99d

Download Submit
memory/624-16-0x0000000013140000-0x0000000013170000-memory.dmp

Filesize
192KB

Download
memory/624-18-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/624-19-0x0000000013140000-0x0000000013170000-memory.dmp

Filesize
192KB

Download
memory/3504-48-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3740-46-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4604-12-0x0000000000400000-0x0000000000402800-memory.dmp

Filesize
10KB

Download

Analysis

Sharing