757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b

General

Target

757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe
Size

27.8MB
MD5

5ade52a10d29ead2af1cac7679c1c629
SHA1

93270f994fc783904bc44117a57ec910f9c8e2f2
SHA256

757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b
SHA512

8a6e1add19f016061262daef315bf9bc8b9d842ea2bef815a07faa2b6d090234a2a68bca89c0c0f38a07e3ed684407be0dc317b922360333b6c1459d30c03301
SSDEEP

393216:rzw1/c86RK7WETJDvrb9nBE425Qa6awhOZzXhZ1tFOn2C4U7/IYhGuu0MGJjQad:41/SitOVwhK9XK2CX7gHgJd

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp

Executes dropped EXE 2 IoCs

pid	Process
404	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
3496	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	Setup.exe
3496	Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3496	Setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 404	1416	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	84
PID 1416 wrote to memory of 404	1416	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	84
PID 1416 wrote to memory of 404	1416	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe	84
PID 404 wrote to memory of 3496	404	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	87
PID 404 wrote to memory of 3496	404	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	87
PID 404 wrote to memory of 3496	404	757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp	87

C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe
"C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\is-76HB0.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-76HB0.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp" /SL5="$A00A2,28499042,139264,C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Users\Admin\AppData\Local\Temp\is-D7S6C.tmp\Installer\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-D7S6C.tmp\Installer\Setup.exe" /setup "C:\Users\Admin\AppData\Local\Temp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.exe" "" "/Ver=13.5.0.1"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IObit\iobitpromotion.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\ProgramData\IObit\iobitpromotion.ini

Filesize
96B

MD5
06db3aebf311de9b7a73a1a0e6c2f174

SHA1
9970566e057c6d208cfce8b8c2ec705b27f475c9

SHA256
e4989b3b02e72bc95b64b5395b4d30478a8c42e94ba6d82aa6bdd734d6f6463b

SHA512
be88968e6ae6cdf36530b99a94a9f7291292ed74ac65b0b41643cd38d3636524337e60945dba16468494cf75ba5dc532665075487572118a0e8efaaa464958ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-76HB0.tmp\757d7d4e75ea8579fb6f57929f745cc59e652dc6e75576bff419460738efb31b.tmp

Filesize
1.2MB

MD5
f5fb27a31d6afc9fdc50f8b712cfafbb

SHA1
f78b8229d9dc4f7e417b61d25d9fd64a9d839d4f

SHA256
49a99807f43bc7d52757bf753a06f79fa7fb088b1e1a51933cdcb68b4bf224b3

SHA512
8f8b2f0572e53cbc14ea71c4c14e21c7302aec28cb97102c4166f21cf641fe7545d14ae7ed722f7a002504a8ba506f47e00b56ef43e273673bb6b70dcc92bfe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D7S6C.tmp\Setup.exe

Filesize
5.8MB

MD5
da7179d9bd82500f700eae8cb8d6e3ab

SHA1
9b2681abde41736f27307b6e61bc07888411c911

SHA256
0c2ec5985c77f45577b027d1a9f75f5c484abd9de723762fb87c74e9ddebeed0

SHA512
72f471d36c29f982d70a5e51e3331e320b69b072d9a90057019e2d014bdb4285771775768a3bc713d4b8024ae5a76c833cbd3e77759c287c9210c5526a2a78db

Download Submit
memory/404-6-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/404-32-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1416-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1416-34-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1416-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/3496-35-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3496-38-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3496-37-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3496-36-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3496-62-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing