df755cbf04518781035d9b7a77e16204b9308e966b797f8dcc731c653a36dc40

General

Target

c68e4b2c97445f0cec20e02919bf6ec3.exe
Size

144KB
MD5

c68e4b2c97445f0cec20e02919bf6ec3
SHA1

9ad07546a947c4f6764060517410741ba4544aad
SHA256

df755cbf04518781035d9b7a77e16204b9308e966b797f8dcc731c653a36dc40
SHA512

3fe4c455ea9b907d13555af544b21ee2c00451af7693d96264621340a529cffc94ee96933e091490a71d7a9fabf371c267c5f7520052a76d4679fd6574c6cf1d
SSDEEP

1536:fDI37DqZ0K4V+yW7JNY0UiURc12H0fjXUJrHSjCXo2HK5vsP+NDMrsrHV2zv/AXC:bI37M6yJNYNuaHSjCXo2HK50PvsQzv

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\atmapi.sys	c68e4b2c97445f0cec20e02919bf6ec3.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\user32.DLL	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\fop.e	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\zed.pa	c68e4b2c97445f0cec20e02919bf6ec3.exe
File opened for modification	C:\Windows\SysWOW64\aston.mt	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\bxrkjwkso	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\dllcache\user32.dll	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\v1.e2	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\kj.je	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\aston.mt	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\nvaux32.dll	c68e4b2c97445f0cec20e02919bf6ec3.exe
File created	C:\Windows\SysWOW64\r33.es	c68e4b2c97445f0cec20e02919bf6ec3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
Token: SeDebugPrivilege	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: SeDebugPrivilege	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe
1720	c68e4b2c97445f0cec20e02919bf6ec3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2484	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe	28
PID 1720 wrote to memory of 2484	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe	28
PID 1720 wrote to memory of 2484	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe	28
PID 1720 wrote to memory of 2484	1720	c68e4b2c97445f0cec20e02919bf6ec3.exe	28

C:\Users\Admin\AppData\Local\Temp\c68e4b2c97445f0cec20e02919bf6ec3.exe
"C:\Users\Admin\AppData\Local\Temp\c68e4b2c97445f0cec20e02919bf6ec3.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" path win32_terminalservicesetting where (__Class!="") call setallowtsconnections 1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\nvaux32.dll

Filesize
272KB

MD5
3595abb538a67bf0ddad66e78e5f5d80

SHA1
e7910bc4b4859fe81b7ff4a620ff2cf30aee74f8

SHA256
a0f518bcc59a6cf60d9ed8536a237ed9fa6012a63c091e90f761bae7755e2770

SHA512
d654098f9d2fad41a18a620b258578c4a92386d47a4948bf9e544ae41449a537aadadd5bce57c6f92bba6489713d0b62666868584b0f7d3a441f5803e707f8af

Download Submit
memory/1720-24-0x0000000000490000-0x00000000004A3000-memory.dmp

Filesize
76KB

Download
memory/1720-2-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1720-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1720-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1720-18-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1720-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1720-29-0x00000000004B0000-0x00000000004B9000-memory.dmp

Filesize
36KB

Download
memory/1720-35-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/1720-41-0x0000000000520000-0x0000000000529000-memory.dmp

Filesize
36KB

Download
memory/1720-46-0x0000000000520000-0x0000000000529000-memory.dmp

Filesize
36KB

Download
memory/1720-47-0x0000000000520000-0x0000000000529000-memory.dmp

Filesize
36KB

Download
memory/1720-48-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1720-50-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing