066354a2c8eab0614f191d9802f66f93d696e01b9fcb557d45b2d4182c2dc566

General

Target

75f4b78408fbb8f28428ee3e63bad775.exe
Size

304KB
MD5

75f4b78408fbb8f28428ee3e63bad775
SHA1

9b5261ca312a4f6fa3d2dd2e4dcd143b6f51aa98
SHA256

066354a2c8eab0614f191d9802f66f93d696e01b9fcb557d45b2d4182c2dc566
SHA512

a92b54858581d8222131dc2a51f47d32d6886d06b6830d6da563ef7b80522064b429d888257abae73fc5c9706f3752ae2ade1229fbb4614dfa813e09a6d5590b
SSDEEP

6144:1rkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizB:1rkHu6/eIo4RXdrIO5/OpVHd6Ky6riz0

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1132	75f4b78408fbb8f28428ee3e63bad775.exe
1132	75f4b78408fbb8f28428ee3e63bad775.exe
1132	75f4b78408fbb8f28428ee3e63bad775.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	75f4b78408fbb8f28428ee3e63bad775.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	75f4b78408fbb8f28428ee3e63bad775.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	75f4b78408fbb8f28428ee3e63bad775.exe
1132	75f4b78408fbb8f28428ee3e63bad775.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 208	1132	75f4b78408fbb8f28428ee3e63bad775.exe	89
PID 1132 wrote to memory of 208	1132	75f4b78408fbb8f28428ee3e63bad775.exe	89
PID 1132 wrote to memory of 208	1132	75f4b78408fbb8f28428ee3e63bad775.exe	89

C:\Users\Admin\AppData\Local\Temp\75f4b78408fbb8f28428ee3e63bad775.exe
"C:\Users\Admin\AppData\Local\Temp\75f4b78408fbb8f28428ee3e63bad775.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin5E92.bat"
  2⤵
  PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\132E788E\cfg\1.ini

Filesize
1KB

MD5
f329fb95ad59c4f00833443d1bed85e4

SHA1
7558c18b5c4cf230704aee7c6ea0493e0e0454be

SHA256
2ddf648f75fb2d7367b6a52f13c9417e356d680007c141fdc29824ccbb0d8f6e

SHA512
67624891869444ede9c589a297413642354a97d8014a4daa2c9ae8a63df92e80bc0e8e0af3ae6f06e5eec4c0bdaeb2170d52587b6bff26e0dfd808c793088981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tsu1D74049D.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin5E92.bat

Filesize
50B

MD5
e7f1d1e5a739a904790607a7188c638f

SHA1
7a1a21b4bb76677e2993d21e553b50af808f074b

SHA256
eb08b647ce844506c8020f835168d53149a9bbc2741d4e2c57b248236eefc0e3

SHA512
26b9c7db44857007d52d95ddfc9c37d9d619f8f8bdfcc695bacaae8316089901e65d50a63d1414226ca93be1f57a023cff726cce67543e31c424d7f23a323abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4B717EFE-EDE5-4540-A7AB-A5C790925C08}\Custom.dll

Filesize
73KB

MD5
e8d86c771d7e23b080921b9803f1654c

SHA1
49d8ef6835a6de734ead4e0b2cbbc65735cd5c17

SHA256
cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21

SHA512
b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4B717EFE-EDE5-4540-A7AB-A5C790925C08}\Readme.txt

Filesize
2KB

MD5
699229b3fe2ee75aefa3d2b54f7e13cb

SHA1
d7cb88e3b7baa98f0c99e89340121a92d315676f

SHA256
1221a175847d62688165a53d220c70d2d4b3a79709d92a56e42becb851af854f

SHA512
c946a55c4ccf4016d2ad52d82fb9e3b13bcb50847d74a8dded515b580fb67b351e7b59a714699f411e2d4e582b020cd6a9283c376bbd6bbb72075fe3ec302463

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4B717EFE-EDE5-4540-A7AB-A5C790925C08}\Setup.exe

Filesize
15KB

MD5
e717f6ce3a7429bfa6d7f3cf66737a4b

SHA1
01f4042589b4ed88c351ffeac256be7a9d884818

SHA256
7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

SHA512
65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4B717EFE-EDE5-4540-A7AB-A5C790925C08}\Setup.ico

Filesize
4KB

MD5
c3926cef276c0940dadbc8142153cec9

SHA1
f8b350d2b7158f5ab147938961439860d77b9cb4

SHA256
0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93

SHA512
5b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4B717EFE-EDE5-4540-A7AB-A5C790925C08}\_Setup.dll

Filesize
167KB

MD5
262cc5a5e5a007ae182c45e41ac35adf

SHA1
999582209e73d92d0040b8092666087aac2cee90

SHA256
ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd

SHA512
2f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b

Download Submit

Analysis

Sharing