dc58aca90e7884d0ad732ea91a33824a37361b8a6ba339d9efa2e9ff2dade94b

General

Target

1a7726867c9d2217785fab6bd7799272.exe
Size

403KB
MD5

1a7726867c9d2217785fab6bd7799272
SHA1

64f8253f295f88fa1fe8d8556c5254cda953450c
SHA256

dc58aca90e7884d0ad732ea91a33824a37361b8a6ba339d9efa2e9ff2dade94b
SHA512

f61b4996423128d7401cce42de3c2968c6611eb722e9235448e7acc0e5a34854fca80eb82080de40cfc9107a4b04c5180aaa2e1012f30ae5f484db62cc8d8b9c
SSDEEP

3072:nniGpcwxIdrijNVKUhmHA3uc4RHlQlEGzOIOK8UzyPaXKu:nnnpcwyojNA3Hs4FHGzOIcUzyPwKu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2948	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	kjdtqjd.exe

Loads dropped DLL 4 IoCs

pid	Process
2948	cmd.exe
2948	cmd.exe
2960	kjdtqjd.exe
2960	kjdtqjd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1744	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2968	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	kjdtqjd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2960	kjdtqjd.exe
2960	kjdtqjd.exe
2960	kjdtqjd.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2960	kjdtqjd.exe
2960	kjdtqjd.exe
2960	kjdtqjd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2948	2312	1a7726867c9d2217785fab6bd7799272.exe	28
PID 2312 wrote to memory of 2948	2312	1a7726867c9d2217785fab6bd7799272.exe	28
PID 2312 wrote to memory of 2948	2312	1a7726867c9d2217785fab6bd7799272.exe	28
PID 2312 wrote to memory of 2948	2312	1a7726867c9d2217785fab6bd7799272.exe	28
PID 2948 wrote to memory of 1744	2948	cmd.exe	30
PID 2948 wrote to memory of 1744	2948	cmd.exe	30
PID 2948 wrote to memory of 1744	2948	cmd.exe	30
PID 2948 wrote to memory of 1744	2948	cmd.exe	30
PID 2948 wrote to memory of 2968	2948	cmd.exe	32
PID 2948 wrote to memory of 2968	2948	cmd.exe	32
PID 2948 wrote to memory of 2968	2948	cmd.exe	32
PID 2948 wrote to memory of 2968	2948	cmd.exe	32
PID 2948 wrote to memory of 2960	2948	cmd.exe	33
PID 2948 wrote to memory of 2960	2948	cmd.exe	33
PID 2948 wrote to memory of 2960	2948	cmd.exe	33
PID 2948 wrote to memory of 2960	2948	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\1a7726867c9d2217785fab6bd7799272.exe
"C:\Users\Admin\AppData\Local\Temp\1a7726867c9d2217785fab6bd7799272.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2312 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1a7726867c9d2217785fab6bd7799272.exe" & start C:\Users\Admin\AppData\Local\kjdtqjd.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 2312
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2968
- - C:\Users\Admin\AppData\Local\kjdtqjd.exe
    C:\Users\Admin\AppData\Local\kjdtqjd.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\kjdtqjd.exe

Filesize
403KB

MD5
1a7726867c9d2217785fab6bd7799272

SHA1
64f8253f295f88fa1fe8d8556c5254cda953450c

SHA256
dc58aca90e7884d0ad732ea91a33824a37361b8a6ba339d9efa2e9ff2dade94b

SHA512
f61b4996423128d7401cce42de3c2968c6611eb722e9235448e7acc0e5a34854fca80eb82080de40cfc9107a4b04c5180aaa2e1012f30ae5f484db62cc8d8b9c

Download Submit
memory/2312-0-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2312-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2312-3-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2948-5-0x0000000001FD0000-0x00000000020DD000-memory.dmp

Filesize
1.1MB

Download
memory/2960-13-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/2960-10-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2960-14-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-15-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-16-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-18-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-19-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-20-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-21-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-22-0x0000000001000000-0x000000000110D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing