82b508beca25dadeb8467d3cfa719a6eb16ad870afda87dd5e40cf112520c983

General

Target

13b28d9f5431c4c4ede2badfd5892fee.exe
Size

854KB
MD5

13b28d9f5431c4c4ede2badfd5892fee
SHA1

e32014b0cbffc33d6f23c89d61e7367a4c917e29
SHA256

82b508beca25dadeb8467d3cfa719a6eb16ad870afda87dd5e40cf112520c983
SHA512

791a3436ad0dc5f18a2ec1ab304890c972f25db3218f0320f86e41949377793fd2d3c27ab98d4f83dd43cb9e498239e9b9a9db00f46b93ca4e2ef07ad2ecd2c7
SSDEEP

24576:Ji2sFbAw0o9MoxaK/uudvvPRBUCjcBEc//////i:TKjDM0VRB2Ec//////i

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2404	boxplayersetup.exe
2752	is-T1JBQ.tmp

Loads dropped DLL 45 IoCs

pid	Process
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
2404	boxplayersetup.exe
2404	boxplayersetup.exe
2404	boxplayersetup.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
2404	boxplayersetup.exe
2752	is-T1JBQ.tmp
2752	is-T1JBQ.tmp
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe
1708	13b28d9f5431c4c4ede2badfd5892fee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	is-T1JBQ.tmp

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 1708 wrote to memory of 2404	1708	13b28d9f5431c4c4ede2badfd5892fee.exe	19
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18
PID 2404 wrote to memory of 2752	2404	boxplayersetup.exe	18

C:\Users\Admin\AppData\Local\Temp\13b28d9f5431c4c4ede2badfd5892fee.exe
"C:\Users\Admin\AppData\Local\Temp\13b28d9f5431c4c4ede2badfd5892fee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\boxplayersetup.exe
  C:\Users\Admin\AppData\Local\Temp\boxplayersetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2404

C:\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp
"C:\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp" /SL4 $70124 "C:\Users\Admin\AppData\Local\Temp\boxplayersetup.exe" 542035 51712
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp

Filesize
92KB

MD5
6cdb299575c0e210dbde97e253949aca

SHA1
f1bd87b4321053b4c603b28829c3a0846e30e2c5

SHA256
8cafad3fe092d0dae2ec64a08d63aefeb7014430bf26e0434db1e00352110cd4

SHA512
602ef49bc1fcd15ada6f9b2b74cc48973096bae05f3cf647e004a043284ba8e2230de43fde3cc68b60cb5bb014961800a23325866f2b9a39db67da1c372e701d

Download Submit
\Users\Admin\AppData\Local\Temp\boxplayersetup.exe

Filesize
750KB

MD5
10e92421f33416c62e258d5c06f82c6a

SHA1
3273e6c5d30b7d9d4fc33d59d772a1129210f634

SHA256
b82d6dbb11b2730f8ed6c3b8ee146c34aa9f7267337dd1d5f357a68691226677

SHA512
74dd74af3ddda2cd867422e4fd51c1cedb48d46e540e0e5717cef70ae5d3d5e5e6f3ce5baea87a9ece1d129d49cc6aae7b42d96d73114385825675eb350f560d

Download Submit
\Users\Admin\AppData\Local\Temp\boxplayersetup.exe

Filesize
139KB

MD5
c694f97a14273d0ebf6190bd13137eb3

SHA1
940371555bf43b6dd5ef40ea610da01041e4bbba

SHA256
a1e69341cdbbbca2ae73052518feb5a647f60fcb65a5931aa14e027a6775f64f

SHA512
d05873e172586f557c995a5cac4e792067d48afae0a5776691ada3ce5fee01f41e0c2baf35bada963ccccf5b967cb8d82df8d82671bb79ae8c2771f043165a94

Download Submit
\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp

Filesize
93KB

MD5
a8281300099566319b9c98b922d7ac91

SHA1
b6a0c3d33e6ed76fa8856f9b1ce1943b13ae110b

SHA256
46da5511b2e8fd4e3fcc769a3be5344bf412f2a894f57fa6e2f35225900502c9

SHA512
4178ff770dc106869fa35b8557019059f5552c43b70eae99c46ad839f24ae6b094cbd07958a4b28577f00b3f68823329e335f19a61b8162100b7d96807ed334a

Download Submit
\Users\Admin\AppData\Local\Temp\nst1DDE.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit
\Users\Admin\AppData\Local\Temp\nst1DDE.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
memory/2404-24-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2404-22-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2404-153-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2752-154-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing