7fefc0e71f55ab245f062987d4e158c271fca6312b626224afff8ad8ba66b099

General

Target

adusetupg_systweakblog-9094_2.exe
Size

12.1MB
MD5

64c338d98a2b5416bb158436043d37d3
SHA1

86325bbd76ec60317777b95b728fc1a9285b8d71
SHA256

7fefc0e71f55ab245f062987d4e158c271fca6312b626224afff8ad8ba66b099
SHA512

cd92f1696b7aa6a8780485508f6c86def31845029560c0a9ce92e0260e36f2e2207267a29f19a86e740a4ff1ffbff0bea045748db334c6550e2afcaea7acad03
SSDEEP

196608:vYDbdIIzFOewbeXIYtH1qw0Hy04UQrLNkIuyP+59XobvvIah7QVcUQ:vYDqIUe34YtH8yDL3P+59XobvDhn

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1224	adusetupg_systweakblog-9094_2.tmp

Loads dropped DLL 2 IoCs

pid	Process
2368	adusetupg_systweakblog-9094_2.exe
1224	adusetupg_systweakblog-9094_2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 4 IoCs

evasion

pid	Process
2680	taskkill.exe
2840	taskkill.exe
2832	taskkill.exe
2712	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1224	adusetupg_systweakblog-9094_2.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 2368 wrote to memory of 1224	2368	adusetupg_systweakblog-9094_2.exe	28
PID 1224 wrote to memory of 2680	1224	adusetupg_systweakblog-9094_2.tmp	29
PID 1224 wrote to memory of 2680	1224	adusetupg_systweakblog-9094_2.tmp	29
PID 1224 wrote to memory of 2680	1224	adusetupg_systweakblog-9094_2.tmp	29
PID 1224 wrote to memory of 2680	1224	adusetupg_systweakblog-9094_2.tmp	29
PID 1224 wrote to memory of 2840	1224	adusetupg_systweakblog-9094_2.tmp	32
PID 1224 wrote to memory of 2840	1224	adusetupg_systweakblog-9094_2.tmp	32
PID 1224 wrote to memory of 2840	1224	adusetupg_systweakblog-9094_2.tmp	32
PID 1224 wrote to memory of 2840	1224	adusetupg_systweakblog-9094_2.tmp	32
PID 1224 wrote to memory of 2832	1224	adusetupg_systweakblog-9094_2.tmp	34
PID 1224 wrote to memory of 2832	1224	adusetupg_systweakblog-9094_2.tmp	34
PID 1224 wrote to memory of 2832	1224	adusetupg_systweakblog-9094_2.tmp	34
PID 1224 wrote to memory of 2832	1224	adusetupg_systweakblog-9094_2.tmp	34
PID 1224 wrote to memory of 2712	1224	adusetupg_systweakblog-9094_2.tmp	36
PID 1224 wrote to memory of 2712	1224	adusetupg_systweakblog-9094_2.tmp	36
PID 1224 wrote to memory of 2712	1224	adusetupg_systweakblog-9094_2.tmp	36
PID 1224 wrote to memory of 2712	1224	adusetupg_systweakblog-9094_2.tmp	36

C:\Users\Admin\AppData\Local\Temp\adusetupg_systweakblog-9094_2.exe
"C:\Users\Admin\AppData\Local\Temp\adusetupg_systweakblog-9094_2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\is-UVCI8.tmp\adusetupg_systweakblog-9094_2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UVCI8.tmp\adusetupg_systweakblog-9094_2.tmp" /SL5="$70126,11802117,861184,C:\Users\Admin\AppData\Local\Temp\adusetupg_systweakblog-9094_2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-C94G4.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
\Users\Admin\AppData\Local\Temp\is-UVCI8.tmp\adusetupg_systweakblog-9094_2.tmp

Filesize
2.6MB

MD5
787f484de3949ea68ed24e8defe8058c

SHA1
6c7c930b6353d19eca32ac380d6bb855d66ef2be

SHA256
e45cf8b3120af05b926f582e6bafe03a5df763f4406137a2867ec3f8f4732dc7

SHA512
39f810b04b32cadebfa19d34c35915bc4d0b63fc80cf1fc0475be687389de6905be8918a32904e5dcc514bc48de9980875e098d1b14a13458a65710f2aa8153e

Download Submit
memory/1224-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1224-15-0x0000000000400000-0x0000000000696000-memory.dmp

Filesize
2.6MB

Download
memory/1224-18-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2368-14-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download

Analysis

Sharing