5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680

General

Target

5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe
Size

606KB
MD5

0a22c338bb24f710b19b09e76094eb32
SHA1

e42fba70554d2ad795e01f28adbe63c180c474dc
SHA256

5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680
SHA512

ddab75d88c1c13bca386fa024a797839f06ac2e7b3eb5f4a0379d700e2f5f03c479f2d748b44a0bb14ac91e6d5ee248dcb91c05a9363abe33e4e28d6985967e3
SSDEEP

12288:N4mjiqrwQIPUPZn+qydoogeYpMthaI69ELRVOwPPbhEMc/l:9TfIPUPZ+dgeYpMPt66LRVO2mMct

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	drive.google.com
43	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\masculate\stretman.ini	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
428	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe
428	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 464 set thread context of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Rh33\varro\dissatisfying.ini	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3700	428	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
428	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe
428	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98
PID 464 wrote to memory of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98
PID 464 wrote to memory of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98
PID 464 wrote to memory of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98
PID 464 wrote to memory of 428	464	5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe	98

C:\Users\Admin\AppData\Local\Temp\5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe
"C:\Users\Admin\AppData\Local\Temp\5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe
  "C:\Users\Admin\AppData\Local\Temp\5f04c6fca105284e0be8855f6e8413af947b2e8159396c945e49f62749c5f680.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 1496
    3⤵
    - Program crash
    PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 428 -ip 428
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx4046.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
memory/428-13-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/428-14-0x00000000770A8000-0x00000000770A9000-memory.dmp

Filesize
4KB

Download
memory/428-15-0x00000000770C5000-0x00000000770C6000-memory.dmp

Filesize
4KB

Download
memory/428-28-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/428-29-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/428-30-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/428-31-0x00000000374C0000-0x000000003780A000-memory.dmp

Filesize
3.3MB

Download
memory/428-32-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/428-33-0x0000000077021000-0x0000000077141000-memory.dmp

Filesize
1.1MB

Download
memory/464-11-0x0000000077021000-0x0000000077141000-memory.dmp

Filesize
1.1MB

Download
memory/464-12-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing