495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c

General

Target

495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
Size

2.7MB
MD5

a285a27e074ef2a209aaa6169d443310
SHA1

f7b28986b7576ed51b58919a13644f466270e316
SHA256

495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c
SHA512

e810ffb7121eca9bdab81dd7ac12f3235a823d9ab01cbe6f977adf142184f776f9596a6623947d35c7cb8eb56a7adb0d42965e07dce8510db0436b69f9bd952a
SSDEEP

49152:9jyT+P66XbOP/ZzA2DItg1Hoaz6wecYfFkURwlhyAuLjf/IVgs5+xP:oTE66yXZ02DwUHoazRofxIhELjf/IVgs

Score

9^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs

resource	yara_rule
behavioral1/memory/1800-1-0x0000000000A10000-0x0000000000CD2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x00300000000143fd-10.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x00300000000143fd-24.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2292-31-0x00000000010A0000-0x0000000001362000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Deletes itself 1 IoCs

pid	Process
2208	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2292	Lorine Michell.exe

Loads dropped DLL 6 IoCs

pid	Process
1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
2896	WerFault.exe
2896	WerFault.exe
2896	WerFault.exe
2896	WerFault.exe
2896	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2292	WerFault.exe	29

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2428	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
2292	Lorine Michell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
Token: SeIncBasePriorityPrivilege	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
Token: SeDebugPrivilege	2292	Lorine Michell.exe
Token: SeIncBasePriorityPrivilege	2292	Lorine Michell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2292	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	29
PID 1800 wrote to memory of 2292	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	29
PID 1800 wrote to memory of 2292	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	29
PID 1800 wrote to memory of 2292	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	29
PID 1800 wrote to memory of 2208	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	30
PID 1800 wrote to memory of 2208	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	30
PID 1800 wrote to memory of 2208	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	30
PID 1800 wrote to memory of 2208	1800	495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe	30
PID 2208 wrote to memory of 2428	2208	cmd.exe	32
PID 2208 wrote to memory of 2428	2208	cmd.exe	32
PID 2208 wrote to memory of 2428	2208	cmd.exe	32
PID 2208 wrote to memory of 2428	2208	cmd.exe	32
PID 2292 wrote to memory of 2896	2292	Lorine Michell.exe	33
PID 2292 wrote to memory of 2896	2292	Lorine Michell.exe	33
PID 2292 wrote to memory of 2896	2292	Lorine Michell.exe	33
PID 2292 wrote to memory of 2896	2292	Lorine Michell.exe	33

C:\Users\Admin\AppData\Local\Temp\495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe
"C:\Users\Admin\AppData\Local\Temp\495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\Lorine Michell.exe
  "C:\Users\Admin\AppData\Local\Temp\Lorine Michell.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 832
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\495b7a281fde282e15b04fb45fe34343c1db9c4b71f0e3b24f3b963ee5c6869c.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lorine Michell.exe

Filesize
2.7MB

MD5
cb85bf5c168d2ac90c24f8303a0cf54f

SHA1
6e176fffd9604391f1f52c31ba3971d026fc6861

SHA256
42b98914a0968b1b25fcbebbc5e57a6ee1e4ebecbbb5bcf4cf08407c0d05e247

SHA512
f92f1df86346ee35ea0c49d2c0ad6ced73d0b9a7520df5067166ef11b7f673285b2ab38142832c0d6a2a18151c1a2b64ea8785730d8260085c28557ba7500e61

Download Submit
\Users\Admin\AppData\Local\Temp\Lorine Michell.exe

Filesize
2.7MB

MD5
c818cad8fec4ec86a663c3391b5a3b95

SHA1
0bb32be461c3c65592a0a4ca79f3fd8327228729

SHA256
0f0d03fb39d44099d08a5ff6d92dd7e26b79ac109f782a028aad55f86163768e

SHA512
d9dce451b1585d73d9be6b46df411028d2ef669a9810a874db4af4715620e0c33579242bdd7d59d2c8c7bf0a161c122511412bfc2c329900abceaf8af82e84ab

Download Submit
memory/1800-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/1800-1-0x0000000000A10000-0x0000000000CD2000-memory.dmp

Filesize
2.8MB

Download
memory/1800-2-0x00000000070C0000-0x00000000072E4000-memory.dmp

Filesize
2.1MB

Download
memory/1800-3-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1800-4-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1800-5-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1800-30-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-29-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-31-0x00000000010A0000-0x0000000001362000-memory.dmp

Filesize
2.8MB

Download
memory/2292-37-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing