7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a

General

Target
7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
Size 9.4MB
Sample240229-nvfjpafh2x
SHA256 7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a
MD5 a578cef19200dbd780313b24af3bac93
SHA1 298513b69de7edd4e151849144aad59f840cdbac
SHA512 c5896ad7dd8df08065d1fad01a1548554cb21df6d2ea77eb4ecba5f4514ad8afbc31c3cc0368e0f7e35ee0a04139fdd47d39994542e76603707856bb49dc4c57
SSDEEP 196608:GjP5uWKaKADc+T24avM/ZSYUG1oA8MBeR0WyZcSGakTcNo:GLcWKarT2bvEZSZiTBeJyfGbge
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2536	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	IDMs.exe

Loads dropped DLL 4 IoCs

pid	Process
2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
2112	IDMs.exe
2112	IDMs.exe
2112	IDMs.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000C50000-0x00000000015C2000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\IDMs.exe	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\IDMs.exe	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
2112	IDMs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2112	2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe	28
PID 2156 wrote to memory of 2112	2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe	28
PID 2156 wrote to memory of 2112	2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe	28
PID 2156 wrote to memory of 2112	2156	7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe	28
PID 2112 wrote to memory of 2536	2112	IDMs.exe	29
PID 2112 wrote to memory of 2536	2112	IDMs.exe	29
PID 2112 wrote to memory of 2536	2112	IDMs.exe	29
PID 2112 wrote to memory of 2536	2112	IDMs.exe	29
PID 2112 wrote to memory of 2588	2112	IDMs.exe	31
PID 2112 wrote to memory of 2588	2112	IDMs.exe	31
PID 2112 wrote to memory of 2588	2112	IDMs.exe	31
PID 2112 wrote to memory of 2588	2112	IDMs.exe	31

C:\Users\Admin\AppData\Local\Temp\7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
"C:\Users\Admin\AppData\Local\Temp\7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Common Files\System\IDMs.exe
  "C:\Program Files (x86)\Common Files\System\IDMs.exe" /S /EN /ND
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\netsh.exe
    netsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.133
    3⤵
    - Modifies Windows Firewall
    PID:2536
- - C:\Windows\SysWOW64\route.exe
    route.exe delete 95.141.193.133
    3⤵
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IDMs.exe

Path C:\Program Files (x86)\Common Files\System\IDMs.exe
Size 8.6MB
SHA256 82602f8f06a7d06c79abb5eb73cba1afb504cee83fec4070d3bb5109022e8abd
MD5 b1fa71250f38f5581f7393a040c0895b
SHA1 e16f53dbb8bd5eab861d33f05d32b684f6d9f15b
SHA512 51b0504eae80b668ac9091bbb0db34fb58a9ab8b040ef7f16a38e4dc5e3d77ef93b8e3c5e2df747e18d450888b9e71b2a18073147bde89140f43e18a3d6366df
SSDEEP 196608:79HftfXmubUqufvFKsPHp0lYuXk6smZLKxcQQw3t4GbM:fPbBuEsPHp0ADmFKxQw36Gw
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 67KB
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar2B8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2B8D.tmp
Size 175KB
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path \Users\Admin\AppData\Local\Temp\nsd15E3.tmp\inetc.dll
Size 24KB
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nsd15E3.tmp\nsExec.dll
Size 7KB
SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
MD5 f27689c513e7d12c7c974d5f8ef710d6
SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2156-0-0x0000000000C50000-0x00000000015C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads