309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417

General

Target

309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
Size

2.0MB
MD5

23f626717d84253e95c463a266a28a4e
SHA1

f1e2ab8fb2f12eae52028ba491a672c79770e052
SHA256

309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417
SHA512

90551396fdd81876b9a4caf1ee5ea38667dfdd99fba58ebbe4e04dbdc183ecbce281c594117e2ad13abf198a286087db393b1df45e0e4ab52c73a25b30a0fca6
SSDEEP

49152:L71kcjGwZPU046Gaut8sCstaHQB6Nvq2TbLJ5R:lkVSx1GPhSQBal/vR

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1900	syncUpd.exe
2648	BroomSetup.exe

Loads dropped DLL 5 IoCs

pid	Process
824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000015cb6-21.dat	upx
behavioral1/files/0x0006000000015cb6-29.dat	upx
behavioral1/memory/2648-31-0x0000000000400000-0x0000000000930000-memory.dmp	upx
behavioral1/memory/2648-41-0x0000000000400000-0x0000000000930000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2620	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	BroomSetup.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1900	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	28
PID 824 wrote to memory of 1900	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	28
PID 824 wrote to memory of 1900	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	28
PID 824 wrote to memory of 1900	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	28
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 824 wrote to memory of 2648	824	309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe	29
PID 2648 wrote to memory of 2044	2648	BroomSetup.exe	30
PID 2648 wrote to memory of 2044	2648	BroomSetup.exe	30
PID 2648 wrote to memory of 2044	2648	BroomSetup.exe	30
PID 2648 wrote to memory of 2044	2648	BroomSetup.exe	30
PID 2044 wrote to memory of 2492	2044	cmd.exe	32
PID 2044 wrote to memory of 2492	2044	cmd.exe	32
PID 2044 wrote to memory of 2492	2044	cmd.exe	32
PID 2044 wrote to memory of 2492	2044	cmd.exe	32
PID 2044 wrote to memory of 2620	2044	cmd.exe	33
PID 2044 wrote to memory of 2620	2044	cmd.exe	33
PID 2044 wrote to memory of 2620	2044	cmd.exe	33
PID 2044 wrote to memory of 2620	2044	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
"C:\Users\Admin\AppData\Local\Temp\309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
  C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
  C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
      4⤵
      Creates scheduled task(s)
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
1.7MB

MD5
eee5ddcffbed16222cac0a1b4e2e466e

SHA1
28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

SHA256
2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

SHA512
8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
896KB

MD5
a5681665ddd8951fd1864b1713257566

SHA1
67b2306e62e06516e525ab004ba12eaf2d069446

SHA256
2ed6dda3f4c65cabff319975bc4d4124677a89fb71cb5fdc0c36af5d196abea6

SHA512
99ef06862b0be0b83ba8cddea22ab36977d809cbc295004c2ca3315ad731fc5b8bc2f7952cdc8f9b52d59bf53fb18cdde6e7f373859be1672235989f46256aa0

Download Submit
\Users\Admin\AppData\Local\Temp\nsiDC8.tmp\INetC.dll

Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
\Users\Admin\AppData\Local\Temp\syncUpd.exe

Filesize
199KB

MD5
04cdeae76554c91315c3524135267d7c

SHA1
4e4bc1eb29a0d745b65c87d64bf80e5a8461b7f8

SHA256
62a4dd1892de69284a7ae05b81b79da497e3840ceb4e8f4f0fd8fc83d4d643b6

SHA512
6d645cdc6335a1df3863ec99f10beb977a8cc177316d26eddce34936ea1428f3b7d82ea2d44d0c36923538b32ce3444220b0b0088383dec279a9c91fbd34376a

Download Submit
memory/824-30-0x0000000005630000-0x0000000005B60000-memory.dmp

Filesize
5.2MB

Download
memory/824-28-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2648-31-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/2648-32-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2648-41-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/2648-43-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads