a82fb11e81e54aa03de46cb5108514a1ae3c206f0f7722c4ade4ebfa1f5a5e56

General

Target

21ae45d9c94e29247cad836e8a1db988.exe
Size

581KB
MD5

21ae45d9c94e29247cad836e8a1db988
SHA1

101cd320181b552dec36863a92ceb1e64616b065
SHA256

a82fb11e81e54aa03de46cb5108514a1ae3c206f0f7722c4ade4ebfa1f5a5e56
SHA512

3fa27a11310484f034f6dcba14a7bebd598eb8506e0c2f951b7a29dbbf55c2d96613b7042773ab8e62d7ab734c6b3bf469782d469c91b4bf216a53a7628463b9
SSDEEP

12288:vPBMDZHksQy+zBlWVTuCIbX0nbW2yUMP/a7Z3nbL:vCDZrQ718VuXKeS7Z3n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4676	1431680551.exe

Loads dropped DLL 2 IoCs

pid	Process
4408	21ae45d9c94e29247cad836e8a1db988.exe
4408	21ae45d9c94e29247cad836e8a1db988.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4548	4676	WerFault.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2472	wmic.exe
Token: SeSecurityPrivilege	2472	wmic.exe
Token: SeTakeOwnershipPrivilege	2472	wmic.exe
Token: SeLoadDriverPrivilege	2472	wmic.exe
Token: SeSystemProfilePrivilege	2472	wmic.exe
Token: SeSystemtimePrivilege	2472	wmic.exe
Token: SeProfSingleProcessPrivilege	2472	wmic.exe
Token: SeIncBasePriorityPrivilege	2472	wmic.exe
Token: SeCreatePagefilePrivilege	2472	wmic.exe
Token: SeBackupPrivilege	2472	wmic.exe
Token: SeRestorePrivilege	2472	wmic.exe
Token: SeShutdownPrivilege	2472	wmic.exe
Token: SeDebugPrivilege	2472	wmic.exe
Token: SeSystemEnvironmentPrivilege	2472	wmic.exe
Token: SeRemoteShutdownPrivilege	2472	wmic.exe
Token: SeUndockPrivilege	2472	wmic.exe
Token: SeManageVolumePrivilege	2472	wmic.exe
Token: 33	2472	wmic.exe
Token: 34	2472	wmic.exe
Token: 35	2472	wmic.exe
Token: 36	2472	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4676	4408	21ae45d9c94e29247cad836e8a1db988.exe	33
PID 4408 wrote to memory of 4676	4408	21ae45d9c94e29247cad836e8a1db988.exe	33
PID 4408 wrote to memory of 4676	4408	21ae45d9c94e29247cad836e8a1db988.exe	33
PID 4676 wrote to memory of 2472	4676	1431680551.exe	20
PID 4676 wrote to memory of 2472	4676	1431680551.exe	20
PID 4676 wrote to memory of 2472	4676	1431680551.exe	20

C:\Users\Admin\AppData\Local\Temp\21ae45d9c94e29247cad836e8a1db988.exe
"C:\Users\Admin\AppData\Local\Temp\21ae45d9c94e29247cad836e8a1db988.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\1431680551.exe
  C:\Users\Admin\AppData\Local\Temp\1431680551.exe 9#2#0#3#0#4#6#9#7#8#9 Jk5JQT0vKikrGCZKU0JNSUA3JxknRTxSV0xSR0M7NigXJkJJUFRFPjQrLykuMCAsQ0U+NCkYJkdQT0FVP05WQjw0KDQ5MSArTTxLTjxJXVVPTDlia21oMSYtc292Kj48TEMkS01QKkFMSiVCRj1GHi9ATEU9QkI8NG4uMzJWME9JQSktMEFDNUssTC47MSpDPyAsRC03KCooJyoeL0EyOScoGSc7KjstLiArPis2JSgXLUQyPSkrFyhISUZCVUBUW0pJQk44Olc9HS9MTEY9TTpLXUVSTD03FyhISUZCVUBUW0g4Rj00Fy1FVUVbT0lFNRcmQ1hCXz9HO0VBRTw7ICxIS01LWDpJRlVTQlI5KhcoTD84TEtWT1FZTEtENBctVko9LhomPUsoNB4vT1VKTkBGPVZOQ0xAT0k/QEY5PjxTUkk9HClATFdJTExURk1BN2trbVwXLVJCVFFMRUJGPlZTU0JSWz44Uks0KR4vRUlAP082KRcmR1NcRFVIOEZBOlZDTkBSVUpLPjw0XV9scGUcKTtIT0VDTUFBX0VKNC8uJSkyOSs4LygoLSsXJlJJSkU5KyssKS0wLzk0NhwpO0hPRUNNQUFfUENEPjUsJi81LDIsKywjKSkxLzI3NTIkR0YYJkw/PUpvdmNjZVkcKWQ1KzAnIk5iZltmdXMoTlAlLScrHCpgK1RPUzArHitZIlJyZmRhaGseKl0uLDAiM14lS2htWl8jM18rbnAcLFkoKCwwJitoY2JeIz5cYWtsICtPSUU1X2tycCIzXR8pXx0pXWVlcTEqKigqKVtccWlkbipjZV9nHClkUnJuUGNkXjxmbmxsbGFgR1hnWV5ccF9hZWxmZnIdKV0vNDAxMjMoMjAqHDBmYW9zaGNoWVtkX25eZ2FsHCteKCsxMTM5LTMvLB0qXTIyLzg0MyouKi8nVzJLeU5zL2tIPmo1S3dBcUc6S1tFSmkwSVRRa0FmXy5DdzR1S3VIZ0hxXmRXQzU3R01iZ0RKK2lYQUkxRXAxXU86bTZIQzRfUT05LkJ3a2JXdkMrRHFiZFdtYXFUUVFSWWQ4NWEvVnNdKS1dTilMbVVtaGJRPWQoQ2dzcVRQQEhOPThvS2phQkt0OTxETCcvT2drck1hMV1QTW5zXlRvaw==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4676

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704411603.txt bios get serialnumber
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704411603.txt bios get version
1⤵
PID:4808

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704411603.txt bios get version
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4676 -ip 4676
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 836
1⤵
- Program crash
PID:4548

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704411603.txt bios get version
1⤵
PID:1652

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704411603.txt bios get version
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1431680551.exe

Filesize
788KB

MD5
eccb1613c27ecea5e67b53cc7e7ae15b

SHA1
5fdaf7204d2e8905c7a0507413718c09d12c487f

SHA256
b72a3ccc00177ca50b893bbf70944cc6dc98ea0001f47fe01ffcb86f2ffd3640

SHA512
c27346025b84d866fc6472db29f5d609b104e11191b8dc02d35d5ed244d7e73c3a2ce02d62ec9013b39e5604df575db77c3a8824a0e85a01ffbe134a0db31358

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704411603.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704411603.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704411603.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu851F.tmp\dkuzcjv.dll

Filesize
153KB

MD5
08f238ec5d2d0118ff860a161aa00567

SHA1
85d40848619d4d9f8e995576b0914b234c7d66c6

SHA256
4b705c5811c8b54281b374c81467c7c7b29bd43c828f0138d1012ac83c15c0bc

SHA512
3a9366038a30008fab7c4e2e29f2eb5629cf2c5c22e209365c4175cd9adef86e52a75e550ff855944d8f39e70913a765099dbbfc3ea0e725433d9020f6a30e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu851F.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu851F.tmp\nsisunz.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing