952d7df4797bd5ecc451fe57c4e160242a111391d183e4713d3b3a9ac737be25

General

Target

Dork Searcher v3.exe
Size

63.7MB
MD5

a324c0d0f457a5cd86de81514605c0d2
SHA1

6137b3183d9dfcdd3f647a9f579079ebd88b5e5e
SHA256

952d7df4797bd5ecc451fe57c4e160242a111391d183e4713d3b3a9ac737be25
SHA512

1b93b37795d54f0b17407661bbdba357bad28ba22a885e9ba589976c455e6ab0f3c46cec27b18839a2693c80bca49bb2254b6e1757f771e2bdda9deafd50f495
SSDEEP

1572864:5zUKleXzeH+IwMvNG83xXcRKzLADd4jyyp287t71FeuIEGMTQtYkVs:5Z+itxsRKzKd4jq8tpsuIMTQtpVs

Score

7^/10

agilenet persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Dork Searcher v3.exeSetup.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Dork Searcher v3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 5 IoCs

Processes:

Setup.exeSetup.exeDork Searcher v3 .exesvchost.exesvchost.exe

pid process

3672 Setup.exe
2924 Setup.exe
3012 Dork Searcher v3 .exe
2692 svchost.exe
1988 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

Dork Searcher v3 .exe

pid process

3012 Dork Searcher v3 .exe

pid	process
3672	Setup.exe
2924	Setup.exe
3012	Dork Searcher v3 .exe
2692	svchost.exe
1988	svchost.exe

pid	process
3012	Dork Searcher v3 .exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3012-53-0x00000000009D0000-0x0000000004912000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Setup.exeSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

Setup.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini Setup.exe
File opened for modification C:\Windows\assembly\Desktop.ini Setup.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Drops file in Windows directory 3 IoCs

Processes:

Setup.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly	Setup.exe
File created	C:\Windows\assembly\Desktop.ini	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Dork Searcher v3.exeSetup.exeSetup.exe

description	pid	process	target process
PID 1752 wrote to memory of 3672	1752	Dork Searcher v3.exe	Setup.exe
PID 1752 wrote to memory of 3672	1752	Dork Searcher v3.exe	Setup.exe
PID 1752 wrote to memory of 2924	1752	Dork Searcher v3.exe	Setup.exe
PID 1752 wrote to memory of 2924	1752	Dork Searcher v3.exe	Setup.exe
PID 1752 wrote to memory of 3012	1752	Dork Searcher v3.exe	Dork Searcher v3 .exe
PID 1752 wrote to memory of 3012	1752	Dork Searcher v3.exe	Dork Searcher v3 .exe
PID 2924 wrote to memory of 2692	2924	Setup.exe	svchost.exe
PID 2924 wrote to memory of 2692	2924	Setup.exe	svchost.exe
PID 3672 wrote to memory of 1988	3672	Setup.exe	svchost.exe
PID 3672 wrote to memory of 1988	3672	Setup.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Dork Searcher v3.exe
"C:\Users\Admin\AppData\Local\Temp\Dork Searcher v3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
3⤵
- Executes dropped EXE
PID:1988

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2924

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
3⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Local\Temp\Dork Searcher v3 .exe
"C:\Users\Admin\AppData\Local\Temp\Dork Searcher v3 .exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log
Filesize
408B

MD5
70f08e6585ed9994d97a4c71472fccd8

SHA1
3f44494d4747c87fb8b94bb153c3a3d717f9fd63

SHA256
87fbf339c47e259826080aa2dcbdf371ea47a50eec88222c6e64a92906cb37fa

SHA512
d381aec2ea869f3b2d06497e934c7fe993df6deac719370bd74310a29e8e48b6497559922d2cb44ace97c4bd7ad00eae8fe92a31081f2119de3ddbb5988af388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.log
Filesize
588B

MD5
2f142977932b7837fa1cc70278e53361

SHA1
0a3212d221079671bfdeee176ad841e6f15904fc

SHA256
961ca2c0e803a7201adb3b656ed3abafc259d6d376e8ade66f0afff10a564820

SHA512
a25e45e41933902bcc0ea38b4daa64e96cbcd8900b446e1326cffb8c91eb1886b1e90686190bdba30d7014490001a732f91f2869bb9987c0213a8d798c7b3421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe
Filesize
477KB

MD5
0e6c9432cba1614fccc232f201028c72

SHA1
6082cf9489faa785c066195f108548e705a6d407

SHA256
c9a2faffee3de29e278a89e54b07edb1f520f5e665480a1002d401fd83cde2e8

SHA512
c341000eb6f10c3ee1fb722914abb8ba2e1a3ab32a0ccdd92561c0604d58924699d3f9886b8bd03ab13223c9c78eef74045b181520298dba3323a2809c670abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\a42e6cb8-6f40-425a-a17c-89ddc5754217\AgileDotNetRT64.dll
Filesize
141KB

MD5
e8641f344213ca05d8b5264b5f4e2dee

SHA1
96729e31f9b805800b2248fd22a4b53e226c8309

SHA256
85e82b9e9200e798e8f434459eacee03ed9818cc6c9a513fe083e72d48884e24

SHA512
3130f32c100ecb97083ad8ac4c67863e9ceed3a9b06fc464d1aeeaec389f74c8bf56f4ce04f6450fd2cc0fa861d085101c433cfa4bec3095f8ebeeb53b739109

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
Filesize
339KB

MD5
301e8d9a2445dd999ce816c17d8dbbb3

SHA1
b91163babeb738bd4d0f577ac764cee17fffe564

SHA256
2ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb

SHA512
4941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip
Filesize
140KB

MD5
bbf128484e7ea29053c6db91849067ea

SHA1
c46ec37265740c349fb265099e47ebbef9369ba1

SHA256
5e6f03b5ae15131c2ad374c563273389b3340168ff647433a6b5e7acce468b05

SHA512
aeb756d2b2238eaa16a82673b6a86b609320abd6eafc4b742d0f5a9fe88fbbf34a1fd7e6ad9d2f30a832e288a3d7b725a73f83616df1d3edee92c8fd06984e7e

Download Submit
memory/1752-3-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/1752-4-0x000000001FE40000-0x000000002030E000-memory.dmp

Filesize
4.8MB

Download
memory/1752-5-0x0000000020310000-0x00000000203AC000-memory.dmp

Filesize
624KB

Download
memory/1752-2-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/1752-1-0x000000001F8C0000-0x000000001F966000-memory.dmp

Filesize
664KB

Download
memory/1752-47-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/1752-0-0x00007FFB55275000-0x00007FFB55276000-memory.dmp

Filesize
4KB

Download
memory/2692-48-0x000000001BE20000-0x000000001BE28000-memory.dmp

Filesize
32KB

Download
memory/2924-27-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/2924-25-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/2924-24-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/2924-51-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/3012-53-0x00000000009D0000-0x0000000004912000-memory.dmp

Filesize
63.3MB

Download
memory/3012-60-0x00007FFB50A40000-0x00007FFB50B8E000-memory.dmp

Filesize
1.3MB

Download
memory/3012-61-0x00007FFB646E0000-0x00007FFB64708000-memory.dmp

Filesize
160KB

Download
memory/3012-62-0x0000000032820000-0x0000000036666000-memory.dmp

Filesize
62.3MB

Download
memory/3012-69-0x00007FFB646E0000-0x00007FFB64708000-memory.dmp

Filesize
160KB

Download
memory/3672-20-0x0000000000840000-0x000000000086C000-memory.dmp

Filesize
176KB

Download
memory/3672-52-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/3672-19-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download
memory/3672-18-0x00007FFB54FC0000-0x00007FFB55961000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads