7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d

General

Target

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe
Size

8.8MB
MD5

2335a750096cb245737b423794866a82
SHA1

29c676cf08535b01889a94bd181bc22f5d70459e
SHA256

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d
SHA512

6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9
SSDEEP

196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Executes dropped EXE 1 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid process

992 7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
Loads dropped DLL 1 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid process

992 7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2296 taskkill.exe
2108 taskkill.exe
4496 taskkill.exe
3000 taskkill.exe

pid	process
992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid	process
992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

pid	process
2296	taskkill.exe
2108	taskkill.exe
4496	taskkill.exe
3000	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

description	pid	process	target process
PID 4988 wrote to memory of 992	4988	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 4988 wrote to memory of 992	4988	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 4988 wrote to memory of 992	4988	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
PID 992 wrote to memory of 4496	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 4496	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 4496	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 3000	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 3000	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 3000	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2296	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2296	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2296	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2108	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2108	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe
PID 992 wrote to memory of 2108	992	7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe
"C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\is-57EHJ.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-57EHJ.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp" /SL5="$70222,8637066,199680,C:\Users\Admin\AppData\Local\Temp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-57EHJ.tmp\7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d.tmp

Filesize
1.2MB

MD5
cd31650b1825f94d40916975931def27

SHA1
797184e1856305b590ea138f6fa4139499c1f60b

SHA256
04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

SHA512
13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EDCC4.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\ipini.ini

Filesize
10B

MD5
d4ba7402ee0b59cbb64b46145f616e89

SHA1
e14bc513b5dc75deb3f4e65205811bf19b9bc5ab

SHA256
7258c316645790abb6f8d8953be2a28eeab6b932edb658d34c6a79e27f6d7d10

SHA512
4a0c03500c0690c0262c84a4c9977332cdd1e24e4424589fbec4a528567ed4bc91d5ed9bf457566da061155d3dc29b4191665322c02aca9f0dbd706e876b099d

Download Submit
C:\Users\Admin\AppData\Roaming\Systweak\adu\sfuni.ini

Filesize
950B

MD5
caf32298001381bb9696645f4db64caa

SHA1
d0e50b705ba2c619dd2f202aa7f8f47e74cf2650

SHA256
81a16e7543fca64fb42230575baeca38a0d6f28b5a957c24b37961a90782d13d

SHA512
3ff840f490f9ad637e427685420ed29591eba2c87cb01a7d4030f684bd93f999d9981c34289f95709138f3d75bb92e30e6560593c849e34acc684b1ac3820589

Download Submit
memory/992-7-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/992-24-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/992-40-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/992-42-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4988-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4988-17-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads