35445e039141a449b773978546b21318bc765f9b9dd5ad51db1fcc6e033b91de

General

Target

9989b4f4c5a1960279eb9d2eaf6d2097.exe
Size

19KB
MD5

9989b4f4c5a1960279eb9d2eaf6d2097
SHA1

16d2139fae08c0c7ec020f87315055e5d2d57261
SHA256

35445e039141a449b773978546b21318bc765f9b9dd5ad51db1fcc6e033b91de
SHA512

3be9c1fdb34c169013e49dba08149f68db3977ac8ad566c78c287e34d0afd96bd8de7184015e04f261c0b2e7221337f4c8642e031174f6afc59893c2a8585a77
SSDEEP

384:mJiWnkWnLmW/GOuODGk0p9A8Gyraamx95aJ/1Sztrrv:egW9L0p9AumxfaMrr

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	9989b4f4c5a1960279eb9d2eaf6d2097.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\melove = "C:\\Windows\\system32\\dream.exe"	9989b4f4c5a1960279eb9d2eaf6d2097.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dream = "C:\\Windows\\system32\\dream.exe"	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	svchost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\s:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\v:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\w:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\y:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\z:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\e:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\l:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\p:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\t:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\i:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\h:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\k:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\q:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\g:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\m:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\o:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\r:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\u:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\x:	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened (read-only)	\??\j:	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\c:\autorun.inf	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened for modification	\??\c:\autorun.inf	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File created	\??\f:\autorun.inf	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened for modification	\??\f:\autorun.inf	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\plmmsbl.dll	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File opened for modification	C:\Windows\SysWOW64\plmmsbl.dll	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File created	C:\Windows\SysWOW64\dream.exe	9989b4f4c5a1960279eb9d2eaf6d2097.exe
File created	C:\Windows\SysWOW64\1.inf	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30

Runs net.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe
2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2700	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	28
PID 2580 wrote to memory of 2700	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	28
PID 2580 wrote to memory of 2700	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	28
PID 2580 wrote to memory of 2700	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	28
PID 2580 wrote to memory of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30
PID 2580 wrote to memory of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30
PID 2580 wrote to memory of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30
PID 2580 wrote to memory of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30
PID 2580 wrote to memory of 2276	2580	9989b4f4c5a1960279eb9d2eaf6d2097.exe	30
PID 2700 wrote to memory of 2824	2700	cmd.exe	31
PID 2700 wrote to memory of 2824	2700	cmd.exe	31
PID 2700 wrote to memory of 2824	2700	cmd.exe	31
PID 2700 wrote to memory of 2824	2700	cmd.exe	31
PID 2824 wrote to memory of 2760	2824	net.exe	32
PID 2824 wrote to memory of 2760	2824	net.exe	32
PID 2824 wrote to memory of 2760	2824	net.exe	32
PID 2824 wrote to memory of 2760	2824	net.exe	32

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer	9989b4f4c5a1960279eb9d2eaf6d2097.exe

C:\Users\Admin\AppData\Local\Temp\9989b4f4c5a1960279eb9d2eaf6d2097.exe
"C:\Users\Admin\AppData\Local\Temp\9989b4f4c5a1960279eb9d2eaf6d2097.exe"
1⤵
- Adds policy Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:2760
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1.inf

Filesize
87B

MD5
48167078ad3c858e3b7ff5397d5cc450

SHA1
df8a4961b4cf5462ca6de00d4ffbe28675896663

SHA256
3e972502a1707fe3494ceeb9d1432f9e54ecbab5631c7355e4de6ca1b7bb4279

SHA512
24a16f36778e5fb99867ac25147248ba069233237b619782c886c6f5d2a95de91c8e2bb553b3f50a5bc78c7058b81f9807fdc46e1db4b746bcc1d74f89c57869

Download Submit
C:\Windows\SysWOW64\plmmsbl.dll

Filesize
1.1MB

MD5
2ee1e467d73642afddb03019f58c252b

SHA1
ea1f3b03f46db029a955190692cecbc571e1d46c

SHA256
5a7d5dafe22082b3ed035d640578ed7b5005edfe80e5c911774ec77a2caff1b3

SHA512
3482715d7c9adbfe61f7834120d1a8fce47ae5d70add285ddcfe8802a5d4a95ae00ae82079b9b9639c5d4fa5126ecfc61e1b09a141c0fea86926e26fc22f9082

Download Submit
F:\sbl.exe

Filesize
19KB

MD5
9989b4f4c5a1960279eb9d2eaf6d2097

SHA1
16d2139fae08c0c7ec020f87315055e5d2d57261

SHA256
35445e039141a449b773978546b21318bc765f9b9dd5ad51db1fcc6e033b91de

SHA512
3be9c1fdb34c169013e49dba08149f68db3977ac8ad566c78c287e34d0afd96bd8de7184015e04f261c0b2e7221337f4c8642e031174f6afc59893c2a8585a77

Download Submit
memory/2276-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2276-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2276-35-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2580-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2580-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2580-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2580-50-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2580-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads