757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b

General

Target

757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe
Size

27.8MB
MD5

5ade52a10d29ead2af1cac7679c1c629
SHA1

93270f994fc783904bc44117a57ec910f9c8e2f2
SHA256

757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b
SHA512

8a6e1add19f016061262daef315bf9bc8b9d842ea2bef815a07faa2b6d090234a2a68bca89c0c0f38a07e3ed684407be0dc317b922360333b6c1459d30c03301
SSDEEP

393216:rzw1/c86RK7WETJDvrb9nBE425Qa6awhOZzXhZ1tFOn2C4U7/IYhGuu0MGJjQad:41/SitOVwhK9XK2CX7gHgJd

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
2036	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe
2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	Setup.exe
2036	Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	Setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 1444 wrote to memory of 2356	1444	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	28
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29
PID 2356 wrote to memory of 2036	2356	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	29

C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe
"C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\is-2NOUO.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2NOUO.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp" /SL5="$4010A,28499042,139264,C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\is-B3O3V.tmp\Installer\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-B3O3V.tmp\Installer\Setup.exe" /setup "C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe" "" "/Ver=13.5.0.1"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IObit\iobitpromotion.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B3O3V.tmp\Installer\Setup.exe

Filesize
5.8MB

MD5
da7179d9bd82500f700eae8cb8d6e3ab

SHA1
9b2681abde41736f27307b6e61bc07888411c911

SHA256
0c2ec5985c77f45577b027d1a9f75f5c484abd9de723762fb87c74e9ddebeed0

SHA512
72f471d36c29f982d70a5e51e3331e320b69b072d9a90057019e2d014bdb4285771775768a3bc713d4b8024ae5a76c833cbd3e77759c287c9210c5526a2a78db

Download Submit
\Users\Admin\AppData\Local\Temp\is-2NOUO.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp

Filesize
1.2MB

MD5
f5fb27a31d6afc9fdc50f8b712cfafbb

SHA1
f78b8229d9dc4f7e417b61d25d9fd64a9d839d4f

SHA256
49a99807f43bc7d52757bf753a06f79fa7fb088b1e1a51933cdcb68b4bf224b3

SHA512
8f8b2f0572e53cbc14ea71c4c14e21c7302aec28cb97102c4166f21cf641fe7545d14ae7ed722f7a002504a8ba506f47e00b56ef43e273673bb6b70dcc92bfe9

Download Submit
memory/1444-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1444-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1444-32-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2036-57-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2356-8-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2356-30-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing