8763598c3d0a94d912df94d6c4b884712069f782205416abc65f4dedd7e4e992

General

Target

c1546b676c3440edd404aff65d6acf17.exe
Size

184KB
MD5

c1546b676c3440edd404aff65d6acf17
SHA1

99c3bf5c2898a4ad6f874e70c58396d81147e2a5
SHA256

8763598c3d0a94d912df94d6c4b884712069f782205416abc65f4dedd7e4e992
SHA512

f36c61f90a6b895d5052e3ed4381f610ad25ff6961d004c2562934507be6d38659d9b659d0e37a05c842c5f920fbac3bc53aff091d8558cc55eb7a1734252319
SSDEEP

3072:t7P1UQa9k7U8TH1/TF0fwsDp3m0QTmKE99vTLxg5J8j/0KyEXRuPeKr4uMvwahe:t7P1UrkA8TVLylp3i099L1h/0KyMRumV

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2536	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2736	system32.exe

Loads dropped DLL 2 IoCs

pid	Process
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system32.exe	c1546b676c3440edd404aff65d6acf17.exe
File opened for modification	C:\Windows\SysWOW64\system32.exe	c1546b676c3440edd404aff65d6acf17.exe
File opened for modification	C:\Windows\SysWOW64\system32.exe	system32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe
896	c1546b676c3440edd404aff65d6acf17.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2736	896	c1546b676c3440edd404aff65d6acf17.exe	28
PID 896 wrote to memory of 2736	896	c1546b676c3440edd404aff65d6acf17.exe	28
PID 896 wrote to memory of 2736	896	c1546b676c3440edd404aff65d6acf17.exe	28
PID 896 wrote to memory of 2736	896	c1546b676c3440edd404aff65d6acf17.exe	28
PID 896 wrote to memory of 2620	896	c1546b676c3440edd404aff65d6acf17.exe	29
PID 896 wrote to memory of 2620	896	c1546b676c3440edd404aff65d6acf17.exe	29
PID 896 wrote to memory of 2620	896	c1546b676c3440edd404aff65d6acf17.exe	29
PID 896 wrote to memory of 2620	896	c1546b676c3440edd404aff65d6acf17.exe	29
PID 896 wrote to memory of 2536	896	c1546b676c3440edd404aff65d6acf17.exe	31
PID 896 wrote to memory of 2536	896	c1546b676c3440edd404aff65d6acf17.exe	31
PID 896 wrote to memory of 2536	896	c1546b676c3440edd404aff65d6acf17.exe	31
PID 896 wrote to memory of 2536	896	c1546b676c3440edd404aff65d6acf17.exe	31
PID 2620 wrote to memory of 2528	2620	cmd.exe	33
PID 2620 wrote to memory of 2528	2620	cmd.exe	33
PID 2620 wrote to memory of 2528	2620	cmd.exe	33
PID 2620 wrote to memory of 2528	2620	cmd.exe	33
PID 2528 wrote to memory of 1992	2528	net.exe	34
PID 2528 wrote to memory of 1992	2528	net.exe	34
PID 2528 wrote to memory of 1992	2528	net.exe	34
PID 2528 wrote to memory of 1992	2528	net.exe	34

C:\Users\Admin\AppData\Local\Temp\c1546b676c3440edd404aff65d6acf17.exe
"C:\Users\Admin\AppData\Local\Temp\c1546b676c3440edd404aff65d6acf17.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\system32.exe
  C:\Windows\system32\system32.exe -NetSata
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\_deleteme.bat
  2⤵
  - Deletes itself
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_deleteme.bat

Filesize
184B

MD5
c83743bcac66e02187fb3648a7d107e9

SHA1
80985bde846b29461f8fe6f2899db5d1c3d996d6

SHA256
6533704134d5434b7928ac4a6106fe72d1dfb61d2126c851d62219610971177b

SHA512
76e293c12911785ba9132d164049984cb401c018398351a01ad973d8ae997c8c3a148de40945b4e8a4e8192d30386bc46b295029eacc22b0c19a7f830bfb2c7d

Download Submit
\Windows\SysWOW64\system32.exe

Filesize
184KB

MD5
c1546b676c3440edd404aff65d6acf17

SHA1
99c3bf5c2898a4ad6f874e70c58396d81147e2a5

SHA256
8763598c3d0a94d912df94d6c4b884712069f782205416abc65f4dedd7e4e992

SHA512
f36c61f90a6b895d5052e3ed4381f610ad25ff6961d004c2562934507be6d38659d9b659d0e37a05c842c5f920fbac3bc53aff091d8558cc55eb7a1734252319

Download Submit
memory/896-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/896-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/896-5-0x0000000002B10000-0x0000000002BD1000-memory.dmp

Filesize
772KB

Download
memory/896-12-0x0000000002B10000-0x0000000002BD1000-memory.dmp

Filesize
772KB

Download
memory/896-22-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/896-23-0x0000000002B10000-0x0000000002BD1000-memory.dmp

Filesize
772KB

Download
memory/2736-14-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing