74f7f30e36d60b1c307a5b26b5370b5fe16ba6386b30fb39495b32e731c2fcd8

General

Target

4b0371d992eb9ffc4681258ce8cc2c49.exe
Size

195KB
MD5

4b0371d992eb9ffc4681258ce8cc2c49
SHA1

1d3e1bd367513d7b92c07c180156ea5d45fdb4cc
SHA256

74f7f30e36d60b1c307a5b26b5370b5fe16ba6386b30fb39495b32e731c2fcd8
SHA512

bed98b200e9ffb1735283cefacff0fb5f703244eacc5ed1288f0c410a7d90c30c25d05dd928475ebd3e729971b06ffec01641668114963a5ae249634eb93edb7
SSDEEP

3072:OdDWmr3eifwGQ7d2mk7B9k9HXnOY33G3IjMwnLiskmhKQZT3eiw:4Z3eiBamnk5Xn7G32P+s1MQZT3ei

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2652	kujvxgx.exe

Loads dropped DLL 4 IoCs

pid	Process
2700	cmd.exe
2700	cmd.exe
2652	kujvxgx.exe
2652	kujvxgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2888	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2620	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	kujvxgx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2652	kujvxgx.exe
2652	kujvxgx.exe
2652	kujvxgx.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2652	kujvxgx.exe
2652	kujvxgx.exe
2652	kujvxgx.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2700	808	4b0371d992eb9ffc4681258ce8cc2c49.exe	28
PID 808 wrote to memory of 2700	808	4b0371d992eb9ffc4681258ce8cc2c49.exe	28
PID 808 wrote to memory of 2700	808	4b0371d992eb9ffc4681258ce8cc2c49.exe	28
PID 808 wrote to memory of 2700	808	4b0371d992eb9ffc4681258ce8cc2c49.exe	28
PID 2700 wrote to memory of 2888	2700	cmd.exe	30
PID 2700 wrote to memory of 2888	2700	cmd.exe	30
PID 2700 wrote to memory of 2888	2700	cmd.exe	30
PID 2700 wrote to memory of 2888	2700	cmd.exe	30
PID 2700 wrote to memory of 2620	2700	cmd.exe	32
PID 2700 wrote to memory of 2620	2700	cmd.exe	32
PID 2700 wrote to memory of 2620	2700	cmd.exe	32
PID 2700 wrote to memory of 2620	2700	cmd.exe	32
PID 2700 wrote to memory of 2652	2700	cmd.exe	33
PID 2700 wrote to memory of 2652	2700	cmd.exe	33
PID 2700 wrote to memory of 2652	2700	cmd.exe	33
PID 2700 wrote to memory of 2652	2700	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\4b0371d992eb9ffc4681258ce8cc2c49.exe
"C:\Users\Admin\AppData\Local\Temp\4b0371d992eb9ffc4681258ce8cc2c49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 808 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4b0371d992eb9ffc4681258ce8cc2c49.exe" & start C:\Users\Admin\AppData\Local\kujvxgx.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 808
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2620
- - C:\Users\Admin\AppData\Local\kujvxgx.exe
    C:\Users\Admin\AppData\Local\kujvxgx.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\kujvxgx.exe

Filesize
195KB

MD5
4b0371d992eb9ffc4681258ce8cc2c49

SHA1
1d3e1bd367513d7b92c07c180156ea5d45fdb4cc

SHA256
74f7f30e36d60b1c307a5b26b5370b5fe16ba6386b30fb39495b32e731c2fcd8

SHA512
bed98b200e9ffb1735283cefacff0fb5f703244eacc5ed1288f0c410a7d90c30c25d05dd928475ebd3e729971b06ffec01641668114963a5ae249634eb93edb7

Download Submit
memory/808-0-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/808-2-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/808-3-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/808-4-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-15-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-11-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2652-14-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-9-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-16-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-17-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-18-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-19-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-21-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-22-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/2652-23-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download

Analysis

Sharing