2cd1c9add3f6d945aab6be3dd4e074e0ec5e3f0ad2ff6d234dac2e7e40304cb6

General

Target

f-v_o5ZAUH49VX.exe
Size

6.4MB
MD5

87df19c27ff3222e369cb74ccfb6908c
SHA1

6728cf6ef5a746055f7552320230319f9cf944b2
SHA256

7ba80ea6b253d43800cdefe020733a5bd499c74124725f99ffcc0dae7503895c
SHA512

3f8987d85ae76b419a11dca78a9ffa830339c436722f2a1332319c19da8ef7816bf7f20a1b3cff1981e9a5dffd15641191f4926da8462023438c966484d4efcd
SSDEEP

98304:PsKY8XzrUQQXlUk+Fa4T96Hpr2zEP+yZ4SaQk1/B8P3WFsnSkxgRZzWytano:k9yXJQX6FT9CS+pk1OosnSLWyb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3128	f-v_o5ZAUH49VX.tmp
5020	audiocapture32.exe

Loads dropped DLL 3 IoCs

pid	Process
3128	f-v_o5ZAUH49VX.tmp
3128	f-v_o5ZAUH49VX.tmp
3128	f-v_o5ZAUH49VX.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 11 IoCs

pid	pid_target	Process	procid_target
3416	5020	WerFault.exe	84
1556	5020	WerFault.exe	84
2144	5020	WerFault.exe	84
1348	5020	WerFault.exe	84
5084	5020	WerFault.exe	84
2212	5020	WerFault.exe	84
1252	5020	WerFault.exe	84
5076	5020	WerFault.exe	84
1776	5020	WerFault.exe	84
1352	5020	WerFault.exe	84
972	5020	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3128	f-v_o5ZAUH49VX.tmp
3128	f-v_o5ZAUH49VX.tmp
5020	audiocapture32.exe
5020	audiocapture32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3128	f-v_o5ZAUH49VX.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3128	3372	f-v_o5ZAUH49VX.exe	80
PID 3372 wrote to memory of 3128	3372	f-v_o5ZAUH49VX.exe	80
PID 3372 wrote to memory of 3128	3372	f-v_o5ZAUH49VX.exe	80
PID 3128 wrote to memory of 4912	3128	f-v_o5ZAUH49VX.tmp	82
PID 3128 wrote to memory of 4912	3128	f-v_o5ZAUH49VX.tmp	82
PID 3128 wrote to memory of 4912	3128	f-v_o5ZAUH49VX.tmp	82
PID 3128 wrote to memory of 5020	3128	f-v_o5ZAUH49VX.tmp	84
PID 3128 wrote to memory of 5020	3128	f-v_o5ZAUH49VX.tmp	84
PID 3128 wrote to memory of 5020	3128	f-v_o5ZAUH49VX.tmp	84

C:\Users\Admin\AppData\Local\Temp\f-v_o5ZAUH49VX.exe
"C:\Users\Admin\AppData\Local\Temp\f-v_o5ZAUH49VX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\is-CRUL0.tmp\f-v_o5ZAUH49VX.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CRUL0.tmp\f-v_o5ZAUH49VX.tmp" /SL5="$50052,6449732,424960,C:\Users\Admin\AppData\Local\Temp\f-v_o5ZAUH49VX.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Audio_Capture_Kit_4302"
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Audio Capture Kit\audiocapture32.exe
    "C:\Users\Admin\AppData\Local\Audio Capture Kit\audiocapture32.exe" 01847199a44dec61a255bca73f69f2eb
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 816
      4⤵
      Program crash
      PID:3416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 824
      4⤵
      Program crash
      PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 808
      4⤵
      Program crash
      PID:2144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1016
      4⤵
      Program crash
      PID:1348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1020
      4⤵
      Program crash
      PID:5084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1020
      4⤵
      Program crash
      PID:2212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1092
      4⤵
      Program crash
      PID:1252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1112
      4⤵
      Program crash
      PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1100
      4⤵
      Program crash
      PID:1776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 952
      4⤵
      Program crash
      PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 812
      4⤵
      Program crash
      PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5020 -ip 5020
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5020 -ip 5020
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5020 -ip 5020
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5020 -ip 5020
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5020 -ip 5020
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5020 -ip 5020
1⤵
PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5020 -ip 5020
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5020 -ip 5020
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5020 -ip 5020
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5020 -ip 5020
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Audio Capture Kit\audiocapture32.exe

Filesize
3.7MB

MD5
40389319fae78363ce746181657f0596

SHA1
de9f40b0cca4e550e8a7daaeb6f74f3f5b03f19e

SHA256
ec5e5b0aef49c5c3bc79dd046d778465562b0898723200dd66e5d4145809e0d9

SHA512
0eac5f7439cdd183c813d73b83417348bd0d19cea4a094c6ae56d303278214f14e1414c2400965d26e0156bd3a61ca870e9b044c4b80a6aa998e99f9be9b8d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7GEBM.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7GEBM.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CRUL0.tmp\f-v_o5ZAUH49VX.tmp

Filesize
692KB

MD5
0638fde3f20193140514c09b485c2af6

SHA1
c630653ae4ac090bbf1dd6a06aca35e5f0bec719

SHA256
db2a87c997a16b4599748f070b8b8bead8c57d0d8154e01b7ffd079c98c153e1

SHA512
0c9d6bdff13fdf128e85d58804498e969c6e05f727db0653463069cac81cd39ecf8541b05a3ebb48df8c72ff9199e2ec54a14151fc0a37f9fb7be687a4b3ba86

Download Submit
memory/3128-79-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3128-6-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3128-81-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3372-3-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3372-78-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3372-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5020-74-0x0000000000400000-0x0000000000BC0000-memory.dmp

Filesize
7.8MB

Download
memory/5020-75-0x0000000000400000-0x0000000000BC0000-memory.dmp

Filesize
7.8MB

Download
memory/5020-76-0x0000000000400000-0x0000000000BC0000-memory.dmp

Filesize
7.8MB

Download
memory/5020-77-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/5020-80-0x0000000000400000-0x0000000000BC0000-memory.dmp

Filesize
7.8MB

Download
memory/5020-85-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing