2172a859b01987c46c2163b0b87fe39e3e60e6920c6aef112b23275b04b21847

General

Target

d4d463092084d3b72af6450faf80d22c.exe
Size

418KB
MD5

d4d463092084d3b72af6450faf80d22c
SHA1

5a04080915d2f4ee6fd36c49c2e1450652407cc3
SHA256

2172a859b01987c46c2163b0b87fe39e3e60e6920c6aef112b23275b04b21847
SHA512

602f27830f636149fc3f20a09ecb61cac3d1ac021fa76a1f84f5eefe7dd2bcb9cc8467436eb697309d1672639e489ce4abb9e0c53a809c8b7267a3ea70df978e
SSDEEP

12288:6QiGTCn7dXYwEZVo1I3QUlcGpX98iR4o:6QiO+XREHD3JlcG1CiR4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3020	d4d463092084d3b72af6450faf80d22c.tmp

Loads dropped DLL 4 IoCs

pid	Process
3068	d4d463092084d3b72af6450faf80d22c.exe
3020	d4d463092084d3b72af6450faf80d22c.tmp
3020	d4d463092084d3b72af6450faf80d22c.tmp
3020	d4d463092084d3b72af6450faf80d22c.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2620	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	d4d463092084d3b72af6450faf80d22c.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3068 wrote to memory of 3020	3068	d4d463092084d3b72af6450faf80d22c.exe	28
PID 3020 wrote to memory of 2272	3020	d4d463092084d3b72af6450faf80d22c.tmp	29
PID 3020 wrote to memory of 2272	3020	d4d463092084d3b72af6450faf80d22c.tmp	29
PID 3020 wrote to memory of 2272	3020	d4d463092084d3b72af6450faf80d22c.tmp	29
PID 3020 wrote to memory of 2272	3020	d4d463092084d3b72af6450faf80d22c.tmp	29
PID 2272 wrote to memory of 2620	2272	cmd.exe	31
PID 2272 wrote to memory of 2620	2272	cmd.exe	31
PID 2272 wrote to memory of 2620	2272	cmd.exe	31
PID 2272 wrote to memory of 2620	2272	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\d4d463092084d3b72af6450faf80d22c.exe
"C:\Users\Admin\AppData\Local\Temp\d4d463092084d3b72af6450faf80d22c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\is-252B2.tmp\d4d463092084d3b72af6450faf80d22c.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-252B2.tmp\d4d463092084d3b72af6450faf80d22c.tmp" /SL5="$8001C,139007,56832,C:\Users\Admin\AppData\Local\Temp\d4d463092084d3b72af6450faf80d22c.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-PR312.tmp\ex.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-PR312.tmp\av.txt

Filesize
24B

MD5
f8f8258012893e0a2c957d226bdd7587

SHA1
ed482b5f912ef2d31e2b231df6b6e3b64967390c

SHA256
c341965a331692b4f79eed856a7da98c550d74fdef27d1241893284f1b51c3d2

SHA512
6e563814e4347ffa1da1d4d26ab45430987d5224c22278e1ee41b207700eb263aaab1e69088a5eeb267fdd385f36a61c0c66415f5df0887162eefbcbec9d19d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PR312.tmp\ex.bat

Filesize
786B

MD5
9cf07532bcdc05ca7f27f1eb85050c52

SHA1
b7c8976792d7876b4a4020de8d915bb4ca937a53

SHA256
2a05371616845c85bdd45f1b9297260217bb3eb85dd3105fc7744c164f2bed05

SHA512
16a1208d5aab0ec826d7801e5078cd919ca9585c3e1cbc8df913a01ac745cc77d0fa49c42901c32a393080942b07014f3bc4ae9d8fe9b95ff574269a9caed271

Download Submit
\Users\Admin\AppData\Local\Temp\is-252B2.tmp\d4d463092084d3b72af6450faf80d22c.tmp

Filesize
694KB

MD5
86462bc76b244bac73ee6ffe47354be2

SHA1
c66462dc233887f86f9e05ee36086de4edfd99b6

SHA256
e3da91f01ffb504352b5e8237a5465d0f492a750a7c9a6cef22b3a5d08230fc9

SHA512
c0cbe3a39c2fd18e257500faacafd9fc8913221278e492b355acf64e6d97ff622a46a325a5c18cee5843a1660fda64dbc3172fac642de77ed12321085d67cb65

Download Submit
\Users\Admin\AppData\Local\Temp\is-PR312.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-PR312.tmp\itdownload.dll

Filesize
201KB

MD5
fda896f0acbb98fa2fd8763f7e0a7b7d

SHA1
87520c200aa1ee03fa627073053b9887147b2975

SHA256
2182268006a950cb31f425e4ce8aa31c9b4d5f7f84dd09e8a854710ddde31b0e

SHA512
2dfc45451a3128ff87910c1cfca91556e69f4cf367b9072e32e0af1676eba1a8c473e061e78971e910ca6d6889ad9b1aca2a4c56186e7003d200fe5f57f39550

Download Submit
memory/2620-24-0x0000000073370000-0x000000007391B000-memory.dmp

Filesize
5.7MB

Download
memory/2620-23-0x0000000073370000-0x000000007391B000-memory.dmp

Filesize
5.7MB

Download
memory/2620-25-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2620-26-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2620-27-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2620-28-0x0000000073370000-0x000000007391B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-17-0x0000000000710000-0x000000000074C000-memory.dmp

Filesize
240KB

Download
memory/3020-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3020-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3020-33-0x0000000000710000-0x000000000074C000-memory.dmp

Filesize
240KB

Download
memory/3020-35-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3068-31-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing