d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877

General

Target

d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe
Size

531KB
MD5

f374e44cda0ddf8355ad99829308e994
SHA1

1576076d2d7fdd8c7c6b80c53f91e3b28ce7093a
SHA256

d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877
SHA512

037f42b6158b5712e3e0f4ce48ecfdaeb25bfd50ab8a451a87de56756123a63e1f77eade8b1f4de6d496e032353d220fd40f6e2eb60cf297f9b5f1d483305f9f
SSDEEP

12288:s49hXhKuYmmYH2pOaHeoX6re6bCCzMRK92B:n9hxKuPc3eoX+e6pMM2

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1100	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Garuda56\sonni.lnk	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3440	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3440	1100	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	83
PID 1100 wrote to memory of 3440	1100	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	83
PID 1100 wrote to memory of 3440	1100	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	83

C:\Users\Admin\AppData\Local\Temp\d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe
"C:\Users\Admin\AppData\Local\Temp\d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized "$Ufortalt=Get-Content 'C:\Users\Admin\AppData\Local\heftig\menusystemets\repressurize\Halvaarets.Div44';$Overreliant=$Ufortalt.SubString(51466,3);.$Overreliant($Ufortalt)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcff42aq.pag.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso6979.tmp\nsExec.dll

Filesize
6KB

MD5
b2639b996a3d69541c78642772283e9f

SHA1
e8a0c678708b8b625234a3ac502e37940ad2992f

SHA256
79aa4f0daf303b02bfcf0306e690378e050003e42c7c9d3e1bd5ad62fb2f3a21

SHA512
fabd2f9dd6ff8887cde99c9ccb7c755722daed0e6d7d332e1811b7a4a0f10daaad3ab750fb90838fdcc8049bda49f0cb84283e007c48e54b117b4de41c321815

Download Submit
C:\Users\Admin\AppData\Local\heftig\menusystemets\repressurize\Halvaarets.Div44

Filesize
50KB

MD5
7f0d4af39cda6466d11eacb2b8e95992

SHA1
e3f60ca2ad7fb1e0ca16e6b09c20f75c556a937c

SHA256
2c45bda7486a34945e077b8fafdbdbabd6c53dff934e13bde0eec29f7917b6b0

SHA512
9b5110fcf6d744d8864a41adef9153663ac9794d5136d9c9bc16074d27e6be0e3cc12f9f223dfacea68386d9e118fdd51bb0f3b7f37941d573c62a487a6a95c0

Download Submit
memory/3440-34-0x00000000065D0000-0x00000000065EE000-memory.dmp

Filesize
120KB

Download
memory/3440-38-0x0000000006B70000-0x0000000006B92000-memory.dmp

Filesize
136KB

Download
memory/3440-21-0x0000000005600000-0x0000000005622000-memory.dmp

Filesize
136KB

Download
memory/3440-22-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/3440-23-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Filesize
408KB

Download
memory/3440-19-0x0000000073E50000-0x0000000074600000-memory.dmp

Filesize
7.7MB

Download
memory/3440-33-0x0000000005FB0000-0x0000000006304000-memory.dmp

Filesize
3.3MB

Download
memory/3440-18-0x0000000003010000-0x0000000003046000-memory.dmp

Filesize
216KB

Download
memory/3440-35-0x0000000006620000-0x000000000666C000-memory.dmp

Filesize
304KB

Download
memory/3440-20-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/3440-37-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

Filesize
104KB

Download
memory/3440-36-0x0000000007680000-0x0000000007716000-memory.dmp

Filesize
600KB

Download
memory/3440-39-0x0000000007CD0000-0x0000000008274000-memory.dmp

Filesize
5.6MB

Download
memory/3440-17-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

Filesize
4KB

Download
memory/3440-41-0x0000000008900000-0x0000000008F7A000-memory.dmp

Filesize
6.5MB

Download
memory/3440-43-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

Filesize
4KB

Download
memory/3440-44-0x0000000073E50000-0x0000000074600000-memory.dmp

Filesize
7.7MB

Download
memory/3440-45-0x0000000073E50000-0x0000000074600000-memory.dmp

Filesize
7.7MB

Download
memory/3440-46-0x0000000073E50000-0x0000000074600000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing