132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73

General

Target

132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe
Size

6.2MB
MD5

1b1d89a29dfa9c8a388a8d0d9e6e172f
SHA1

c6864b625d3f7a61b3e669e822f5e6e5ffb4e0af
SHA256

132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73
SHA512

ed97e27ebb0e62739cdece2a62f895cd937568145ce0b4ac6e13768ca7b2c4988015cbb2f2c0fa56ca20bff959b50fc3b13a49fea5bbb767303d1868fa7abe98
SSDEEP

196608:xeQzyEmN28Q3q+bo48G4mNUaIJRHk3yvY3V:xFyjebo48G4mNUaI8GYl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2548	mulloyall.exe

Loads dropped DLL 6 IoCs

pid	Process
1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
2548	mulloyall.exe
2548	mulloyall.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 1660 wrote to memory of 2520	1660	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe	28
PID 2520 wrote to memory of 2728	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	29
PID 2520 wrote to memory of 2728	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	29
PID 2520 wrote to memory of 2728	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	29
PID 2520 wrote to memory of 2728	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	29
PID 2520 wrote to memory of 2548	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	31
PID 2520 wrote to memory of 2548	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	31
PID 2520 wrote to memory of 2548	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	31
PID 2520 wrote to memory of 2548	2520	132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp	31

C:\Users\Admin\AppData\Local\Temp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe
"C:\Users\Admin\AppData\Local\Temp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\is-5OFAQ.tmp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5OFAQ.tmp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp" /SL5="$400F4,6234242,56832,C:\Users\Admin\AppData\Local\Temp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Mulloy_5113"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Mulloy\mulloyall.exe
    "C:\Users\Admin\AppData\Local\Mulloy\mulloyall.exe" 0b03b5d4cfd20fcc43fb198f0519e603
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Mulloy\mulloyall.exe

Filesize
4.9MB

MD5
811e06c97d4125798af40c095a215898

SHA1
745b4d759bdc6c0fff23dbe9dba7abbea338ec65

SHA256
6e11e4b83d391df3ed338e0ff2b552852e8bf0eaf568a845035e426e460edae7

SHA512
3f96b970b94528aea77a64023cc79231960ca1176fcf862f357af0e30c76cb765d995049019b9a8f65c7db7dff3f431e61a751a4fdbda39dc06450b21e3e8f17

Download Submit
\Users\Admin\AppData\Local\Temp\is-5OFAQ.tmp\132cff8910cdf5dfad82e2efcdf554d5c7d3d33468db34dfe482275e57f5ba73.tmp

Filesize
692KB

MD5
f9fdb0ae28ac99715101ddd3bbf7d7c0

SHA1
1655f0199520314f79cb7b85cdaca73929eb48de

SHA256
d3ca078aaf42859ad45c1a1802407c42af64fe1918bf7b07d82fca50ece45ec4

SHA512
bdb1f6fbc1535cc83c3fb137cf17e09a5040fd8eeb9b404e87f6f9c5fca9b66e86271bcd7e73e2ef4dc1698fc2b473fc4575a5903c679fed8eb67cb219b2dbda

Download Submit
\Users\Admin\AppData\Local\Temp\is-A5P3U.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-A5P3U.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
\Users\Admin\AppData\Local\Temp\is-A5P3U.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1660-81-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1660-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1660-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2520-13-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2520-78-0x0000000003980000-0x000000000425E000-memory.dmp

Filesize
8.9MB

Download
memory/2520-82-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2520-84-0x0000000003980000-0x000000000425E000-memory.dmp

Filesize
8.9MB

Download
memory/2548-80-0x0000000000400000-0x0000000000CDE000-memory.dmp

Filesize
8.9MB

Download
memory/2548-79-0x0000000000400000-0x0000000000CDE000-memory.dmp

Filesize
8.9MB

Download
memory/2548-83-0x0000000000400000-0x0000000000CDE000-memory.dmp

Filesize
8.9MB

Download

Analysis

Sharing