5b5469810f632806e9b5a6413f77620d49355f169b36db9b23e2ba70add03823

General

Target

5813e6fa8812154a32c8a83f889dc3ec.exe
Size

41KB
MD5

5813e6fa8812154a32c8a83f889dc3ec
SHA1

7112a2313d80914b484d13d7808d47b304b42e91
SHA256

5b5469810f632806e9b5a6413f77620d49355f169b36db9b23e2ba70add03823
SHA512

918cbaff595458069af3ad5d15d6fbcb9f609311fa660c0375dcc19c3a75320bf1a4d66cd77818334a9915f88dfad873219d75342538a9012f81a63a2729e97c
SSDEEP

768:WV9x24oiDT0LEVH6gkbOPKVgIY1C7IPwb/HL5A7yAGtN89yZmEcnFuf:0D24oaVajbOPKeI1VTtAWAGzZmEj

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7880F99D-BC3G-14DF-89AS-1190DR808E85}	5813e6fa8812154a32c8a83f889dc3ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7880F99D-BC3G-14DF-89AS-1190DR808E85}\StubPath = "C:\\Windows\\system32\\System64.exe"	5813e6fa8812154a32c8a83f889dc3ec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	5813e6fa8812154a32c8a83f889dc3ec.exe

Executes dropped EXE 1 IoCs

pid	Process
3632	System64.exe

Loads dropped DLL 2 IoCs

pid	Process
3632	System64.exe
3632	System64.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64.exe	5813e6fa8812154a32c8a83f889dc3ec.exe
File opened for modification	C:\Windows\SysWOW64\System64.exe	5813e6fa8812154a32c8a83f889dc3ec.exe
File created	C:\Windows\SysWOW64\KMe.bat	5813e6fa8812154a32c8a83f889dc3ec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 4032	3632	System64.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	4032	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3632	System64.exe
3632	System64.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3632	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	88
PID 3144 wrote to memory of 3632	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	88
PID 3144 wrote to memory of 3632	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	88
PID 3144 wrote to memory of 2308	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	89
PID 3144 wrote to memory of 2308	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	89
PID 3144 wrote to memory of 2308	3144	5813e6fa8812154a32c8a83f889dc3ec.exe	89
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91
PID 3632 wrote to memory of 4032	3632	System64.exe	91

C:\Users\Admin\AppData\Local\Temp\5813e6fa8812154a32c8a83f889dc3ec.exe
"C:\Users\Admin\AppData\Local\Temp\5813e6fa8812154a32c8a83f889dc3ec.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\System64.exe
  "C:\Windows\system32\System64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\userinit.exe
    "C:\Windows\system32\userinit.exe"
    3⤵
    PID:4032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 12
      4⤵
      Program crash
      PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4032 -ip 4032
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\KMe.bat

Filesize
184B

MD5
168f50b7e38735c7169753fdaf854bc3

SHA1
c6c82c8803e560b292123175160c090eb5d51c1d

SHA256
e4e9e0d77adbe4e6c0a5ab7276c9a46b360d851fbda56543872fb04ea92fd430

SHA512
54cf1333308a1230282dd7726ca87e3530451aaa2f68eb057585df5c2e9669be3ce8b8118b7ff22a6c5963e93bbb695afe730edd0d5640e7237f0fbb1abb153a

Download Submit
C:\Windows\SysWOW64\System64.exe

Filesize
41KB

MD5
5813e6fa8812154a32c8a83f889dc3ec

SHA1
7112a2313d80914b484d13d7808d47b304b42e91

SHA256
5b5469810f632806e9b5a6413f77620d49355f169b36db9b23e2ba70add03823

SHA512
918cbaff595458069af3ad5d15d6fbcb9f609311fa660c0375dcc19c3a75320bf1a4d66cd77818334a9915f88dfad873219d75342538a9012f81a63a2729e97c

Download Submit
memory/3144-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3144-1-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3144-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3144-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3632-15-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/3632-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3632-22-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4032-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4032-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads