017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1

General

Target

017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
Size

527KB
MD5

afca14738e00c61a837d450b38a3f067
SHA1

bc07bcaa858fd87418563b54f1e3197a252c0ee8
SHA256

017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1
SHA512

50f084c2ffd0b6592bea5face7092294003812421009e8241c8045c117aa9ae4e802bd4fb56398df06670ffbad57683c9157fc1b91a28443720b13fbf300772c
SSDEEP

12288:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnXo:wPWwcOq6g2BVpxbVo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5968	GetX64BTIT.exe

Loads dropped DLL 1 IoCs

pid	Process
3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3296 set thread context of 5996	3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5544	5996	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 5996	3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	99
PID 3296 wrote to memory of 5996	3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	99
PID 3296 wrote to memory of 5996	3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	99
PID 3296 wrote to memory of 5996	3296	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	99
PID 5996 wrote to memory of 5968	5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	101
PID 5996 wrote to memory of 5968	5996	017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe	101

C:\Users\Admin\AppData\Local\Temp\017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
"C:\Users\Admin\AppData\Local\Temp\017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe
  "C:\Users\Admin\AppData\Local\Temp\017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
    "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
    3⤵
    - Executes dropped EXE
    PID:5968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 612
    3⤵
    - Program crash
    PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5996 -ip 5996
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm5669.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt

Filesize
28B

MD5
cb51543b58ee527856324a9d0aaa3cfa

SHA1
a59bd9f9e2728422e016309352d3566812c13ded

SHA256
d3d4aab8ef7cc1f16bd6336ea95d9fe56ff8a9aceeb6651dd2f1ebf62d1e71c3

SHA512
0bff6624e71aa21b0bc95090e8ae1a1213272b8ae08f62c2e4023159e1b7016efe0391fec35bf9cdc644bf8a4fde4c754c5aa14b163e3d21196557cc40985bdf

Download Submit
memory/5996-12-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-10-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-11-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-9-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5996-13-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-15-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-14-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5996-6-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5996-22-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-23-0x00000000004C0000-0x000000000055F000-memory.dmp

Filesize
636KB

Download
memory/5996-25-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Resubmissions

Analysis

Sharing