4f3e62070efc1e0e7c3e9c66510f14c200bf45faff24d80a22a4b41ae97c9d68

General

Target

ikpo.exe
Size

787KB
MD5

6c984dd6faad761de792293a9cd30c1e
SHA1

bc17076ca2251c31ae3b0cccc2030de0fa6dcd74
SHA256

a59da8c3da0e8aa6621ef7aeb786958ea98691060e741ac5abcb328d37f6e947
SHA512

05ea3f148d5b172d6dda8ace37f557a53b18deeed983e65b7c927e45c9edc5b9fe7b7def6761a0a167655f90e165ca0cbf0024833b2f107cd578e6c520ed4f54
SSDEEP

12288:DDGTAY8L9W1KOFxJUuuz9PhigvacmLzlUannZIVlUfND1uAbf43vGxIRK/dUbz:IAzRW1KMxJ6igTmKKnZIVlUPM3Un1Ubz

Score

4^/10

execution

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

ikpo.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Misaddressing.Sta	ikpo.exe
File opened for modification	C:\Program Files (x86)\Common Files\Priory\Nedbrsmngde123.ini	ikpo.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

Powershell.exe

pid process

3356 Powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5004 3356 WerFault.exe Powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Powershell.exe

pid process

3356 Powershell.exe
3356 Powershell.exe
3356 Powershell.exe
3356 Powershell.exe
3356 Powershell.exe
3356 Powershell.exe
3356 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 3356 Powershell.exe

pid	process
3356	Powershell.exe

pid	pid_target	process	target process
5004	3356	WerFault.exe	Powershell.exe

pid	process
3356	Powershell.exe
3356	Powershell.exe
3356	Powershell.exe
3356	Powershell.exe
3356	Powershell.exe
3356	Powershell.exe
3356	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	3356	Powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ikpo.exePowershell.exe

description	pid	process	target process
PID 2156 wrote to memory of 3356	2156	ikpo.exe	Powershell.exe
PID 2156 wrote to memory of 3356	2156	ikpo.exe	Powershell.exe
PID 2156 wrote to memory of 3356	2156	ikpo.exe	Powershell.exe
PID 3356 wrote to memory of 888	3356	Powershell.exe	cmd.exe
PID 3356 wrote to memory of 888	3356	Powershell.exe	cmd.exe
PID 3356 wrote to memory of 888	3356	Powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ikpo.exe
"C:\Users\Admin\AppData\Local\Temp\ikpo.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -windowstyle minimized "$Dulles = Get-Content 'C:\Users\Admin\AppData\Local\Temp\Personalerabatterne\Servicegarantiers.Met' ; $Sherryens=$Dulles.SubString(71538,3);.$Sherryens($Dulles) "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 2508
    3⤵
    - Program crash
    PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3356 -ip 3356
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Genkbsvrdis.ini

Filesize
40B

MD5
67f7fb5e22799f4047a15a3914f69c2d

SHA1
06dba7dcdd82dc1f93dcfade2b685ac8ea686825

SHA256
ab226586c4f054353e0649d4cc3ea8b1fd9c6cc30e6a2c86c79bda996e5cd70b

SHA512
43d9acf5082cca2b4f615ccc866f2b69b2b8d290b807f13334cd924a1191dd9dd872a279689a625869976511e2ecbc6bafedafa1b39aa5c8cf23ab2b2a2cf1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Personalerabatterne\Servicegarantiers.Met

Filesize
69KB

MD5
2833201aa6f7fc20aa9bc6c30ada040c

SHA1
5c2248094eeef1dff5ee628b114bd16e06860abd

SHA256
a651d2d6b6ba530c879db1dc2ac0deedaf5bef5202c669523c9f3ea4c5fdf69d

SHA512
35cc2c08029c3a64481617a49ce0fe5e7100cedc0b63086e5beb9db40e766bba161fd314572a570aa7ff1842b9b9efd667b425ccf7643abbc74ff4b1aa009bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3qgmwla.1th.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3356-3174-0x0000000005840000-0x0000000005B94000-memory.dmp

Filesize
3.3MB

Download
memory/3356-3176-0x0000000005D40000-0x0000000005D8C000-memory.dmp

Filesize
304KB

Download
memory/3356-3161-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/3356-3162-0x0000000004D50000-0x0000000004D72000-memory.dmp

Filesize
136KB

Download
memory/3356-3163-0x0000000004DF0000-0x0000000004E56000-memory.dmp

Filesize
408KB

Download
memory/3356-3164-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/3356-3159-0x0000000004F30000-0x0000000005558000-memory.dmp

Filesize
6.2MB

Download
memory/3356-3158-0x0000000004770000-0x00000000047A6000-memory.dmp

Filesize
216KB

Download
memory/3356-3175-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Filesize
120KB

Download
memory/3356-3160-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/3356-3178-0x0000000006230000-0x000000000624A000-memory.dmp

Filesize
104KB

Download
memory/3356-3177-0x0000000006CD0000-0x0000000006D66000-memory.dmp

Filesize
600KB

Download
memory/3356-3179-0x0000000006280000-0x00000000062A2000-memory.dmp

Filesize
136KB

Download
memory/3356-3180-0x0000000007320000-0x00000000078C4000-memory.dmp

Filesize
5.6MB

Download
memory/3356-3157-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/3356-3182-0x0000000007F50000-0x00000000085CA000-memory.dmp

Filesize
6.5MB

Download
memory/3356-3183-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing