db1e3b9f03008745a59ff36d6da30bcc5dc496aed12b65909632d142c4357359

General

Target

3b440b25022aa6cf85f5503c230c0099.exe
Size

128.5MB
MD5

3b440b25022aa6cf85f5503c230c0099
SHA1

6783368217b6b56941b80085047ded5fb06177af
SHA256

db1e3b9f03008745a59ff36d6da30bcc5dc496aed12b65909632d142c4357359
SHA512

a37b27ecd8a555e5673dd3b012a5b260253b40c0e90d4cbe88d138e8c59e7d6f23b8e336b4442f7b8b57ab9a69e61cde5dea531b64eac525e31d124f269ec352
SSDEEP

3145728:a5+ShtbCnbLEN4Mfvl6qJ1WE7oswHiEzCsLRURS:aVp6qJUliEzhLRUQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2556	3b440b25022aa6cf85f5503c230c0099.tmp

Loads dropped DLL 2 IoCs

pid	Process
2160	3b440b25022aa6cf85f5503c230c0099.exe
2556	3b440b25022aa6cf85f5503c230c0099.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1244	tasklist.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	3b440b25022aa6cf85f5503c230c0099.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	tasklist.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2160 wrote to memory of 2556	2160	3b440b25022aa6cf85f5503c230c0099.exe	28
PID 2556 wrote to memory of 2652	2556	3b440b25022aa6cf85f5503c230c0099.tmp	29
PID 2556 wrote to memory of 2652	2556	3b440b25022aa6cf85f5503c230c0099.tmp	29
PID 2556 wrote to memory of 2652	2556	3b440b25022aa6cf85f5503c230c0099.tmp	29
PID 2556 wrote to memory of 2652	2556	3b440b25022aa6cf85f5503c230c0099.tmp	29
PID 2652 wrote to memory of 1244	2652	cmd.exe	31
PID 2652 wrote to memory of 1244	2652	cmd.exe	31
PID 2652 wrote to memory of 1244	2652	cmd.exe	31
PID 2652 wrote to memory of 1244	2652	cmd.exe	31
PID 2652 wrote to memory of 2512	2652	cmd.exe	32
PID 2652 wrote to memory of 2512	2652	cmd.exe	32
PID 2652 wrote to memory of 2512	2652	cmd.exe	32
PID 2652 wrote to memory of 2512	2652	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\3b440b25022aa6cf85f5503c230c0099.exe
"C:\Users\Admin\AppData\Local\Temp\3b440b25022aa6cf85f5503c230c0099.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\is-4NONQ.tmp\3b440b25022aa6cf85f5503c230c0099.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4NONQ.tmp\3b440b25022aa6cf85f5503c230c0099.tmp" /SL5="$30144,133704293,1157120,C:\Users\Admin\AppData\Local\Temp\3b440b25022aa6cf85f5503c230c0099.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "FileWatcher.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1244
  - - C:\Windows\SysWOW64\find.exe
      find /c /i "FileWatcher.exe"
      4⤵
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
\Users\Admin\AppData\Local\Temp\is-4NONQ.tmp\3b440b25022aa6cf85f5503c230c0099.tmp

Filesize
3.3MB

MD5
c6654bb92522673222b03a06ea14a659

SHA1
f9ee3c84bbcb5279eb2d9cdab34757f41e50e604

SHA256
ace803081126f1c85568f039b43458f95799c85fe1052994a0b2815896677da8

SHA512
5a02490ad98ada7e0d8f6607408c6a2c0b2bbe3468cc8a95f373d014af5cb1d7bd53aa654d03f5771d00dee96f522b451498f59c5b4cf11206e436bc888a57dc

Download Submit
\Users\Admin\AppData\Local\Temp\is-EUHE9.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
memory/2160-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2160-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2160-15-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2556-8-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/2556-16-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing