0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff

General

Target

0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
Size

303KB
MD5

1e82bb8e71453ef778c46e26e7afc85b
SHA1

438dcfe8abe89838fe4c40c3b3296e1a9a317964
SHA256

0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff
SHA512

07101aa4d547d6c02823ee35169525e1231d31898c1523305dbe5a7cec058c4225a2cdf12eaf9f8e3e8b5aeea157c9fcd66f6d507004f3aad17b79c5e7ef10d0
SSDEEP

6144:Irko9uEo2S1YnQmCX492DkwNP3qpYF2JA06CzL31tE5ioKpbgLoMmGvgk052lABy:IrkAu6/eIo4R/P1EioKMbmGvgZ2lAB/q

Score

9^/10

discovery

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320d-21.dat	INDICATOR_SUSPICIOUS_References_SecTools

Loads dropped DLL 3 IoCs

pid	Process
1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 396	1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe	92
PID 1300 wrote to memory of 396	1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe	92
PID 1300 wrote to memory of 396	1300	0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe	92

C:\Users\Admin\AppData\Local\Temp\0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe
"C:\Users\Admin\AppData\Local\Temp\0304b3c796055d7e5485bf68c3a7a8606385826a04e5340d64413c8a413658ff.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin6228.bat"
  2⤵
  PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\488B7DFF\cfg\1.ini

Filesize
524B

MD5
91f6c1b0eb4eb31c6db8597e3e24f237

SHA1
a8540996a3c374efe2c57017bc98e657d625f06e

SHA256
5b4f976deef13d2c400d0aec8e806b8e3feac9d72509f7c97b975525124b4db3

SHA512
14c33059ea6b5e4fb52724441b9772ddcc7d2565a7ab287bca1908a28833bf4acaf3243363a2283d485e87e70e7a385b8967b459674f27bb9e7a430b5d062ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TsuC526809C.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin6228.bat

Filesize
50B

MD5
5159f3fc59b4f15efe315219b167e71e

SHA1
d3559e8186bae4d611ade08ac67feb8253edf7c5

SHA256
3348d36a71487d7ed5cb9cfa76de068ef7cfef13ab1013cfc068802daeed61a9

SHA512
90d4542e2657b0c155ec6d4a74780d9b4069582409b7864987810a7cc2259f23f04ce1bf9efe2f930c27044df283268ebc31dfe5356f7a6018cb0c1335ec1e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0D959A93-CB46-48DD-AA36-8364D676B865}\Custom.dll

Filesize
73KB

MD5
6aa25ff36323131e638e1d57afe646aa

SHA1
4da3d2343c07c0d5652b255af3f50521b13d5ff1

SHA256
46341d5f415b96337c561a908b0ab47280325b96d3f86ed323681674ee94cdd7

SHA512
5acadfde0b4818d4fccad8b8c4f97bf249d2f08bf567970a93ad53851b9358607140238fb630bf0d3aee7207efea0a78ee6765f9a140dd432f43eccf50a18161

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0D959A93-CB46-48DD-AA36-8364D676B865}\Readme.txt

Filesize
2KB

MD5
890248ab742a5501f97694d7ec28c592

SHA1
a5e95c326de9807b09b4a2fc074547061630eddd

SHA256
7b40d7a823c8ba2655ce91322af3648e42b32df81df0021a5808ad9436224ffb

SHA512
517b9054e147910f7a2e04414043a765f7ea94ce21e676c444f598d6007debee0d51964b2c764070336afa9ca5b05aef6d37d26734996c075efd7b10fda1018e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0D959A93-CB46-48DD-AA36-8364D676B865}\Setup.exe

Filesize
15KB

MD5
e717f6ce3a7429bfa6d7f3cf66737a4b

SHA1
01f4042589b4ed88c351ffeac256be7a9d884818

SHA256
7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

SHA512
65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0D959A93-CB46-48DD-AA36-8364D676B865}\Setup.ico

Filesize
4KB

MD5
c3926cef276c0940dadbc8142153cec9

SHA1
f8b350d2b7158f5ab147938961439860d77b9cb4

SHA256
0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93

SHA512
5b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0D959A93-CB46-48DD-AA36-8364D676B865}\_Setup.dll

Filesize
164KB

MD5
03c0118365077ca9ab839b7fa3d961fe

SHA1
d201e52c3e25bda0e7cde1371527f3f24b365b2c

SHA256
9b7f1db242c5377628c02229acf7f930b53848aba9fb5e6b03bd9846d493bb4e

SHA512
9625c2e172705e582b6f54c336ff7245cd60e71b9ada6f2370fb3932d218c95411970a18d198b0a64b8c41dc7bb723ab007503d817a9794e88d9a0f063e1f9be

Download Submit

Analysis

Sharing