fc974bb1d58f640869da192d76d7600eeec7e766375066774047f93e8062918a

General

Target

111da61f61dc6b7425f5b6b46de36baa.exe
Size

293KB
MD5

111da61f61dc6b7425f5b6b46de36baa
SHA1

6315924ed224dcc3b6bdfd901a4bba867b72dfb9
SHA256

fc974bb1d58f640869da192d76d7600eeec7e766375066774047f93e8062918a
SHA512

849228e0a0957669c4e0bcb19a563247109407537a0d7e7b860d4758c0e82e0964ebfdcc5f95cc2242bbfba0edbb32e0d131d648340985d940d4305058381052
SSDEEP

6144:wkLcp+1ahqFTCNRExkjn+P55VseLuVLg78/J5R1oVEWSdb3z7ZSS:wjyahqKRExaY0eLuVsA/J5rumz/ES

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000200000001e7e3-7.dat	aspack_v212_v242
behavioral2/files/0x000500000001e7e8-15.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	111da61f61dc6b7425f5b6b46de36baa.exe

Deletes itself 1 IoCs

pid	Process
2540	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4952	Minser.exe
2520	SVCHOSI.EXE

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\NetMeeting\Mole.ini	Minser.exe
File created	C:\Program Files\NetMeeting\MINMole.exe	Minser.exe
File created	C:\Program Files\NetMeeting\Mole.Mol	Minser.exe
File created	C:\Program Files\NetMeeting\Install.dll	Minser.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SVCHOSI.EXE	111da61f61dc6b7425f5b6b46de36baa.exe
File opened for modification	C:\Windows\SVCHOSI.EXE	111da61f61dc6b7425f5b6b46de36baa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4932	4952	WerFault.exe	94
2380	4952	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE
2520	SVCHOSI.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4952	1528	111da61f61dc6b7425f5b6b46de36baa.exe	94
PID 1528 wrote to memory of 4952	1528	111da61f61dc6b7425f5b6b46de36baa.exe	94
PID 1528 wrote to memory of 4952	1528	111da61f61dc6b7425f5b6b46de36baa.exe	94
PID 1528 wrote to memory of 2520	1528	111da61f61dc6b7425f5b6b46de36baa.exe	96
PID 1528 wrote to memory of 2520	1528	111da61f61dc6b7425f5b6b46de36baa.exe	96
PID 1528 wrote to memory of 2520	1528	111da61f61dc6b7425f5b6b46de36baa.exe	96
PID 1528 wrote to memory of 2540	1528	111da61f61dc6b7425f5b6b46de36baa.exe	98
PID 1528 wrote to memory of 2540	1528	111da61f61dc6b7425f5b6b46de36baa.exe	98
PID 1528 wrote to memory of 2540	1528	111da61f61dc6b7425f5b6b46de36baa.exe	98
PID 4952 wrote to memory of 4932	4952	Minser.exe	100
PID 4952 wrote to memory of 4932	4952	Minser.exe	100
PID 4952 wrote to memory of 4932	4952	Minser.exe	100
PID 4952 wrote to memory of 1268	4952	Minser.exe	102
PID 4952 wrote to memory of 1268	4952	Minser.exe	102
PID 4952 wrote to memory of 1268	4952	Minser.exe	102

C:\Users\Admin\AppData\Local\Temp\111da61f61dc6b7425f5b6b46de36baa.exe
"C:\Users\Admin\AppData\Local\Temp\111da61f61dc6b7425f5b6b46de36baa.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\Minser.exe
  "C:\Users\Admin\AppData\Local\Temp\Minser.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 404
    3⤵
    - Program crash
    PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 404
    3⤵
    - Program crash
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c DEL.BAT
    3⤵
    PID:1268
- C:\Windows\SVCHOSI.EXE
  C:\Windows\SVCHOSI.EXE -netsvcs
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Deleteme.bat
  2⤵
  - Deletes itself
  PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4952 -ip 4952
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DEL.BAT

Filesize
184B

MD5
3b9cbb23cd3e1a35b9a16d2d2948b3ea

SHA1
709909f14e1fa600512735ed4eed9a1c006d373e

SHA256
0fc1248cfc8656a08985b8ba7f0920728aa018958aae15647006c3b2a0e32eea

SHA512
e14cb8b784fcef274f0a491ce8f14256aca8204b62a2186a275daceb842b717523329d0cc11919ca84c13bb63035e3102a5aa3fddd5ab6d7d2eed944f016d9bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deleteme.bat

Filesize
184B

MD5
4471cac4d624f4ab3f0d5e25ea23d1a0

SHA1
be57b1a34632f755f2102b7121dd340e69e9c32d

SHA256
0cbeb4b1b2e2428398dbba149cf48dae4ddd9cca3fb3871373c501f7d3d80737

SHA512
605cfbf3cf0156e9c205194b94dbe484f2de409197e06912fe0ddb0c69b9db8e4233a932cdf3d2c1a3c6eda89c7815825ca9b271f0c1be04d4399f58fdff6168

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minser.exe

Filesize
123KB

MD5
0789ac0e9b18ed0af4881b371714cb6c

SHA1
7a0a7810a5436aa0bfa53d9a1503fc871540a230

SHA256
acdae96260e1e563d207219c271b9d048c55fe0f1f44b2f9b8e8394e385d44b0

SHA512
413df0125646980a0315f0086980edeffd7dc5183175667c91adf3641b4d30996ca07fbbc6745bcd325a4335539a4a493288ecb558dacedafaac9cd8b7cdbb6c

Download Submit
C:\Windows\SVCHOSI.EXE

Filesize
293KB

MD5
111da61f61dc6b7425f5b6b46de36baa

SHA1
6315924ed224dcc3b6bdfd901a4bba867b72dfb9

SHA256
fc974bb1d58f640869da192d76d7600eeec7e766375066774047f93e8062918a

SHA512
849228e0a0957669c4e0bcb19a563247109407537a0d7e7b860d4758c0e82e0964ebfdcc5f95cc2242bbfba0edbb32e0d131d648340985d940d4305058381052

Download Submit
memory/1528-13-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1528-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1528-21-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1528-2-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2520-17-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2520-23-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2520-25-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2520-26-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4952-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4952-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4952-34-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing