49760c50b74756c8856e7dbf4670b93efe7af05ba82e1c85e69047aa55f72ad9

General

Target

Tyvstarterne.exe
Size

436KB
MD5

cab110d55fbabf1ce703cde3030b62a1
SHA1

25c43773812ad6f4123d9c470b994098a9c0548f
SHA256

49760c50b74756c8856e7dbf4670b93efe7af05ba82e1c85e69047aa55f72ad9
SHA512

34ee297e52dc3afd04f9e24aba6071b54fe538340be65c9b3e4fa17bd5fe9adebff0b0656661f28139c0e047757b2da5c5acf144d583d8bd7e1d4d95533c64fe
SSDEEP

6144:7pkXGh6tHk47We3uM/PZPRPgiIToQIt/oAT91317Aqr/ZUJhZNrV:2ZHkkWeh/PZJYjT+pT91RAiSJxr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2368	Tyvstarterne.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2676	Tyvstarterne.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2368	Tyvstarterne.exe
2676	Tyvstarterne.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2676	2368	Tyvstarterne.exe	28
PID 2676 set thread context of 1208	2676	Tyvstarterne.exe	21
PID 2676 set thread context of 848	2676	Tyvstarterne.exe	33
PID 848 set thread context of 1208	848	secinit.exe	21

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Egetforbrug211\Sindsoprrenes.sto	Tyvstarterne.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
2676	Tyvstarterne.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe
848	secinit.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2368	Tyvstarterne.exe
2676	Tyvstarterne.exe
1208	Explorer.EXE
1208	Explorer.EXE
848	secinit.exe
848	secinit.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 2368 wrote to memory of 2676	2368	Tyvstarterne.exe	28
PID 1208 wrote to memory of 848	1208	Explorer.EXE	33
PID 1208 wrote to memory of 848	1208	Explorer.EXE	33
PID 1208 wrote to memory of 848	1208	Explorer.EXE	33
PID 1208 wrote to memory of 848	1208	Explorer.EXE	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\Tyvstarterne.exe
  "C:\Users\Admin\AppData\Local\Temp\Tyvstarterne.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Tyvstarterne.exe
    "C:\Users\Admin\AppData\Local\Temp\Tyvstarterne.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2676
- C:\Windows\SysWOW64\secinit.exe
  "C:\Windows\SysWOW64\secinit.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy317E.tmp\System.dll

Filesize
11KB

MD5
fc3772787eb239ef4d0399680dcc4343

SHA1
db2fa99ec967178cd8057a14a428a8439a961a73

SHA256
9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

SHA512
79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

Download Submit
memory/848-55-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/848-51-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2368-10-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2368-11-0x0000000077650000-0x0000000077726000-memory.dmp

Filesize
856KB

Download
memory/2368-12-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2676-38-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-16-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/2676-15-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-39-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-40-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-41-0x0000000036210000-0x0000000036513000-memory.dmp

Filesize
3.0MB

Download
memory/2676-42-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-44-0x0000000077650000-0x0000000077726000-memory.dmp

Filesize
856KB

Download
memory/2676-49-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-14-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2676-13-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2676-54-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing