92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649

General

Target

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
Size

326KB
MD5

813b27000f6d14feeed80b3c79f6f315
SHA1

6983f661dd24a415cef35cad7f630e3dc394e574
SHA256

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649
SHA512

f6a7f7371da6c3523a6813fa4c4a22627d8491cb86012a9406ffa46211353215836851934e2831508e252d8a6a475e2665dda76948c62e43f05777f274e56fcd
SSDEEP

6144:A9X0GAbjQDWx8o891Ulavtj7IB+VzvI9E4GM5bVbYd2aNk49IAnmmh13M:G0t/ioK1UlEFa+lvgEQbncmM13M

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

pid	process
4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

pid	process
4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
3164	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

description	pid	process	target process
PID 4524 set thread context of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Drops file in Windows directory 2 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

pid process

4524 92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

description	pid	process	target process
PID 4524 wrote to memory of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
PID 4524 wrote to memory of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
PID 4524 wrote to memory of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
PID 4524 wrote to memory of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
PID 4524 wrote to memory of 3164	4524	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
"C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
"C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk399F.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk399F.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk399F.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
02ef06455bd445bd88f3cce6c1773ac1

SHA1
d1d0175a38f26385dcac95253e42a5aa8fa3da1c

SHA256
be7177c31e8c4ff36ca51946e3a12b17578a3ac275f352909c58e23d2e15708d

SHA512
2d04bed8539201db7289afd3bdb41061c460b011e9fe4b52afb51c7dfd3230002d798c9add88da6ffa2d6b0fcb7a7c817da0c2c4233766fa8b523dce23109302

Download Submit
memory/3164-378-0x0000000077448000-0x0000000077449000-memory.dmp

Filesize
4KB

Download
memory/3164-379-0x0000000077465000-0x0000000077466000-memory.dmp

Filesize
4KB

Download
memory/3164-380-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/3164-382-0x00000000773C1000-0x00000000774E1000-memory.dmp

Filesize
1.1MB

Download
memory/4524-376-0x00000000773C1000-0x00000000774E1000-memory.dmp

Filesize
1.1MB

Download
memory/4524-377-0x0000000074224000-0x0000000074225000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads