7394ee8ddb65ac8259b13576834fc9976c839f11eb1e13c05d8f2c145d04cd85

General

Target

BILL OF LOADING/BILL OF LOADING.exe
Size

906KB
MD5

63b7c9c97cb399ef233ce10e83b65663
SHA1

85e539468312c87fc6daed7164f246e5fa638f20
SHA256

feac8bae828a3756389b379ae1bc0eda56bdcbec371c62bd3c980ffe11c1b0a0
SHA512

137d2579c257ee22e7416fad42dcbb2e24c20a6a2ea9079a58bf7f8d30ab6203837646e74b24142bf015f806f26de5522edb40255fd4b479f9ba6e8b9dcd7fa2
SSDEEP

24576:f2O/GlPO2+Bl8CXU+b+lwmxhKbH3w1GthA0E:Bz8t+alwmxUT3zg0E

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

epr.exeepr.exe

pid process

1852 epr.exe
2944 epr.exe
Loads dropped DLL 5 IoCs

Processes:

BILL OF LOADING.exeepr.exe

pid process

1644 BILL OF LOADING.exe
1644 BILL OF LOADING.exe
1644 BILL OF LOADING.exe
1644 BILL OF LOADING.exe
1852 epr.exe

pid	process
1852	epr.exe
2944	epr.exe

pid	process
1644	BILL OF LOADING.exe
1644	BILL OF LOADING.exe
1644	BILL OF LOADING.exe
1644	BILL OF LOADING.exe
1852	epr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

epr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\goals = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40633691\\epr.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\40633691\\CRI_BM~1"	epr.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

epr.exe

description pid process target process

PID 2944 set thread context of 2204 2944 epr.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

epr.exe

pid process

1852 epr.exe

description	pid	process	target process
PID 2944 set thread context of 2204	2944	epr.exe	RegSvcs.exe

pid	process
1852	epr.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

BILL OF LOADING.exeepr.exeepr.exe

description	pid	process	target process
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1644 wrote to memory of 1852	1644	BILL OF LOADING.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 1852 wrote to memory of 2944	1852	epr.exe	epr.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe
PID 2944 wrote to memory of 2204	2944	epr.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\BILL OF LOADING\BILL OF LOADING.exe
"C:\Users\Admin\AppData\Local\Temp\BILL OF LOADING\BILL OF LOADING.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\40633691\epr.exe
"C:\Users\Admin\AppData\Local\Temp\40633691\epr.exe" cri=bmv
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Local\Temp\40633691\epr.exe
C:\Users\Admin\AppData\Local\Temp\40633691\epr.exe C:\Users\Admin\AppData\Local\Temp\40633691\JQVNL
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
4⤵
PID:2204

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40633691\JQVNL
Filesize
86KB

MD5
458a1b6d11ccc54ff99f06fafbcc4f15

SHA1
a52b6d318b797b3dbece1ba5c0fb87f212de81f7

SHA256
433a04b587e62bd4baf7192d783bc4fdea4ce2ebb1a951332e03f32e46463f61

SHA512
f7d73f100ee0b5f9e79f7fb119e1b0123b65a3d1d6ec8c7bec487f6b7027cb51a8a1262bf838dc97c0a0a39dfbef9a25dd1cdcb6d192cafe73d333e43cd3d879

Download Submit
C:\Users\Admin\AppData\Local\Temp\40633691\cri=bmv
Filesize
183KB

MD5
ca49d5e6c03a09032728e91d192b9905

SHA1
ebbc137ac900d5e8fea261606024f35078ab2a21

SHA256
f3d52b4c5fbcc79cdb3a249401cf5413df1e4d24656a5767e22380a0d1bbdc8d

SHA512
4fbdef69b005276cb7e0129d6571d40a27dbcfd47c40c1d77c62a81c3694f341094188f94382087875a4032d11382aeb6b714e2bca9f3640d66c3ab52c84ac0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\40633691\ipg.icm
Filesize
64B

MD5
7a80edf15dc0a33c0019c9b37d38bc1c

SHA1
b27c1be7d270b7478a1d7781bf1bef2bb7dd3893

SHA256
db50b5f644811c57f4591bffb64d6aad80e48547318dc6a0831872e9c28f26e9

SHA512
e6f39ed9885e781ebffd67f9589add54747e632320aa6997256b3e7c827b8e41e37e27c6de697f082feb5a76d2cd972dc4f981cc886080d435af04edd89a77e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\40633691\wcn.ico
Filesize
399B

MD5
c91231980cac0c054acb16d337e660f6

SHA1
a26bd4f0b3ba8b212c59b77b38e0a1105875071c

SHA256
262e13318a1fe6de6fcabc2240323a50680164f0b4d553210542744c6f46330d

SHA512
2f9c65ee51e859580d9ba51c5d6d2c3fcd69004ff029a28858d2fc33049964308ea6f255e56d6329cfd5e6f15d3f76d5b12cec6c4c73463c947bcf0faa822071

Download Submit
C:\Users\Admin\AppData\Local\Temp\40633691\wdv.ppt
Filesize
635KB

MD5
d271c6cc1e107d4812b14b6aca3e8af4

SHA1
4f829384cf691c8a257936ca1858a9607ce71fbf

SHA256
f9c07a3bf95df9704c38fa941894fc3b0c5b79d862afb47a6b92ef0b3a5ad462

SHA512
4925016c1c937a1a2e60fa5db9a976f91e099e4d65f1bc5dc3c8894474c0f0d7ef464016b403d4ecfeca506de4abff7a74de4ef29d3f32f89e134d178ef16753

Download Submit
\Users\Admin\AppData\Local\Temp\40633691\epr.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/2204-126-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads