7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d

General

Target

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe
Size

8.8MB
MD5

2335a750096cb245737b423794866a82
SHA1

29c676cf08535b01889a94bd181bc22f5d70459e
SHA256

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d
SHA512

6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9
SSDEEP

196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid process

2240 7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid	process
2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Loads dropped DLL 4 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid	process
3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe
2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2568 taskkill.exe
2536 taskkill.exe
2212 taskkill.exe
3052 taskkill.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid process

2240 7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid	process
2568	taskkill.exe
2536	taskkill.exe
2212	taskkill.exe
3052	taskkill.exe

pid	process
2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

description	pid	process	target process
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 3068 wrote to memory of 2240	3068	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 2240 wrote to memory of 2568	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2568	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2568	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2568	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2536	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2536	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2536	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2536	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2212	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2212	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2212	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 2212	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 3052	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 3052	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 3052	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 2240 wrote to memory of 3052	2240	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe
"C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\is-NLMVP.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NLMVP.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp" /SL5="$5014E,8637066,199680,C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BC7.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
\Users\Admin\AppData\Local\Temp\is-NLMVP.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Filesize
1.2MB

MD5
cd31650b1825f94d40916975931def27

SHA1
797184e1856305b590ea138f6fa4139499c1f60b

SHA256
04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

SHA512
13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

Download Submit
\Users\Admin\AppData\Local\Temp\is-QBNVC.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-QBNVC.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
memory/2240-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2240-47-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2240-139-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2240-140-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3068-46-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads