5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3

General

Target

5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe
Size

12KB
MD5

0e9020b2cbb1a0d1eae43611d40cfae0
SHA1

9ec5a4d7f7225722a8555f8a0490e7c5029a0505
SHA256

5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3
SHA512

e17c125e0e34b8d79ba84d148643a1a1fb6d0c03f0d1e87715d51e2c9a4d469f16ad8bac92ad21bb31fc3c58e1297df0d243c3bbddbddf33cdcced4d1f592bc0
SSDEEP

384:ZL7li/2z0q2DcEQvdhcJKLTp/NK9xaGQ:pAM/Q9cGQ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

tmp1B7.tmp.exe

pid process

2704 tmp1B7.tmp.exe
Executes dropped EXE 1 IoCs

Processes:

tmp1B7.tmp.exe

pid process

2704 tmp1B7.tmp.exe
Loads dropped DLL 1 IoCs

Processes:

5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe

pid process

944 5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe

description pid process

Token: SeDebugPrivilege 944 5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe

pid	process
2704	tmp1B7.tmp.exe

pid	process
2704	tmp1B7.tmp.exe

pid	process
944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe

description	pid	process
Token: SeDebugPrivilege	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exevbc.exe

description	pid	process	target process
PID 944 wrote to memory of 1844	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	vbc.exe
PID 944 wrote to memory of 1844	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	vbc.exe
PID 944 wrote to memory of 1844	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	vbc.exe
PID 944 wrote to memory of 1844	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	vbc.exe
PID 1844 wrote to memory of 1804	1844	vbc.exe	cvtres.exe
PID 1844 wrote to memory of 1804	1844	vbc.exe	cvtres.exe
PID 1844 wrote to memory of 1804	1844	vbc.exe	cvtres.exe
PID 1844 wrote to memory of 1804	1844	vbc.exe	cvtres.exe
PID 944 wrote to memory of 2704	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	tmp1B7.tmp.exe
PID 944 wrote to memory of 2704	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	tmp1B7.tmp.exe
PID 944 wrote to memory of 2704	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	tmp1B7.tmp.exe
PID 944 wrote to memory of 2704	944	5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe	tmp1B7.tmp.exe

C:\Users\Admin\AppData\Local\Temp\5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe
"C:\Users\Admin\AppData\Local\Temp\5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dkl01aei\dkl01aei.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC26122C1A4E44AAB22BF7FEF809F84.TMP"
3⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\tmp1B7.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp1B7.tmp.exe" C:\Users\Admin\AppData\Local\Temp\5d9c51a61fd258899bf0653ac24467be9cfbb5015e15435713f634dfc7f68be3.exe
2⤵
- Deletes itself
- Executes dropped EXE
PID:2704

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RE.resources
Filesize
2KB

MD5
5ccfb9c53464e213f7048a8857c4a52f

SHA1
ead0d2bafdb515e3ba2d6a776ae25b7781e70c7a

SHA256
e8b2e26ebfe3d2760681e4a33a85e78a676526de91ad6fcd76d7d1c04ce3fcff

SHA512
5842cbffc694ef79aaa8383fb3cdf926c6638586ef8d263e676b3c8c336792b1b15677baab03c5da2c7c7243c1d33e2ee2f8adb2dc60bcdc141669b4aa4cc063

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES34B.tmp
Filesize
1KB

MD5
3e9c7c63240d78afb8566c1a9bf1cbf9

SHA1
977226999681cbf626089447f719fcc6f7b53d34

SHA256
bb3f79269bf290cb4910d827dbf33bcbe6fd937a6b2fe324a05b77cf60227456

SHA512
fae570f3430f89547b1a726bd73e1cac9c7e9702be0dc460b1276439907a17c37ee6f750b59605eb13b23331ca4e3cf69c84da9489fce5da658c7ad70e93d704

Download Submit
C:\Users\Admin\AppData\Local\Temp\dkl01aei\dkl01aei.0.vb
Filesize
2KB

MD5
db22362d3ce66fb73b11d9031ee5e89f

SHA1
da24a62904b089306f78f1509f6c90a05f7f7605

SHA256
028de93e17e57b7a467c50e8d6a3e01f99201800dc02155d4a91b902f9f4b1ab

SHA512
30758e54bc238fe79b378c37d182c0329ff6b2cef9df581240289d1440f45c5df9642c97a24877b57c0d21f1257a8509d935e69e82247479b3bc03287c58f08e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dkl01aei\dkl01aei.cmdline
Filesize
272B

MD5
25a6a89555388215696299924a557401

SHA1
1e892de6a4529d0b0211144aa6ac6e95655886af

SHA256
35e5835a9e5b5fc7b842028810567f7ac4cf985b04b48fa883ad64fd11a4b5f9

SHA512
c4d0f6ba24a91aca3dcec1ca7aee7242afe6a283aa7f8a7c0c32544c0f1cc9396c6547a7ca98695fcb92e6fc563c0944029f04d8add672fb63a2868740fdec10

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1B7.tmp.exe
Filesize
12KB

MD5
37ff33618b3fd498e7937509c81bdda3

SHA1
9b002120a607b561db6437c533d2997c733c013e

SHA256
0d74dd9d911720160feed6e8cc2731e6707c82b4b326786d9223d0a8f3bc7a49

SHA512
9a986cbb9042367b0af49d5364bd88184431cb58b6fa70fb622c72dcca047536550a3dd5a228c33bd63bdb0b10eb462dd74331e5eb84435aadcbe61601a6b9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcDC26122C1A4E44AAB22BF7FEF809F84.TMP
Filesize
1KB

MD5
2cf21ab983ccd145dc7dc54734d35c86

SHA1
0112ed6026dc31b19280e994d50c1329a5717b5e

SHA256
a0239e694b21cd4440a190b073c072fbdce984cbaadb58b44317381a617cd1ec

SHA512
3f1332ee0666b18be6c2de90da55834f951b2f95b8d109452c9378795838cb9e8426815a9c97d953435d6a7c33eb62fff3a302308f730c919659974648c4e752

Download Submit
memory/944-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/944-1-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/944-7-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/944-24-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-23-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing