99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81

General

Target

99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe
Size

5.3MB
MD5

496d60dac38d7cc0df82e6d94e2ba7c5
SHA1

1ecbaba1caa209afaf3749d30a7f13bfa04d37e0
SHA256

99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81
SHA512

69fb8f41da9454d8cf989e4823c4b41d84a0eaa9289b8baf744e494f7b8fac5c2279ad08decae7c75cc8c466c0b5369251142697ec939adb5efb1f275853b149
SSDEEP

98304:oeV2RdpF0BIsndGaX6tJJQv2FKA75OpVclc02vDRZTEo:1V2fpF0imo3u0jc02vVZoo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2916	nemu-downloader.exe
2608	ColaBoxChecker.exe
1228	HyperVChecker.exe
2868	HyperVChecker.exe

Loads dropped DLL 12 IoCs

pid	Process
1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe
2916	nemu-downloader.exe
2916	nemu-downloader.exe
2916	nemu-downloader.exe
2916	nemu-downloader.exe
2916	nemu-downloader.exe
2608	ColaBoxChecker.exe
2608	ColaBoxChecker.exe
2916	nemu-downloader.exe
420	Process not Found
2916	nemu-downloader.exe
2052	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	nemu-downloader.exe
2916	nemu-downloader.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 1668 wrote to memory of 2916	1668	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	30
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 2608	2916	nemu-downloader.exe	31
PID 2916 wrote to memory of 1228	2916	nemu-downloader.exe	34
PID 2916 wrote to memory of 1228	2916	nemu-downloader.exe	34
PID 2916 wrote to memory of 1228	2916	nemu-downloader.exe	34
PID 2916 wrote to memory of 1228	2916	nemu-downloader.exe	34
PID 2916 wrote to memory of 2868	2916	nemu-downloader.exe	36
PID 2916 wrote to memory of 2868	2916	nemu-downloader.exe	36
PID 2916 wrote to memory of 2868	2916	nemu-downloader.exe	36
PID 2916 wrote to memory of 2868	2916	nemu-downloader.exe	36

C:\Users\Admin\AppData\Local\Temp\99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe
"C:\Users\Admin\AppData\Local\Temp\99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\7z7881F684\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z7881F684\nemu-downloader.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\7z7881F684\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z7881F684\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\7z7881F684\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z7881F684\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\7z7881F684\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z7881F684\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z7881F684\ColaBoxChecker.exe

Filesize
4.0MB

MD5
839708e3f96cf055436fa08d6205263c

SHA1
a4579f8cb6b80fe3fd50099794f63eb51be3292f

SHA256
1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752

SHA512
ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7881F684\HyperVChecker.exe

Filesize
117KB

MD5
dbd84c6083e4badf4741d95ba3c9b5f8

SHA1
4a555adf8e0459bfd1145d9bd8d91b3fff94aad0

SHA256
9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39

SHA512
fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7881F684\baseboard

Filesize
114B

MD5
128ab14c5e8a0bcd5d05408aadef0e95

SHA1
a68badad3ec9e381284640532eab3d8da63c6516

SHA256
bcb51fe59205a675a5a2fbe2b05ecccb32c91ead00f72b85e1f8171638bf9092

SHA512
70b29966615d41760e9a85aac3773c1469a0842896b1fb69b9a45c7984d7cf8e567139cb8943cfdebd4cd6c535914ab743a38c81a876f1c899a7afff972a4d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7881F684\config.ini

Filesize
353B

MD5
d07d0cbdc62effb1028505d0a4c8fa0f

SHA1
7013e566476d899e883109d5f52522d95e97ccb4

SHA256
2787e6215c962e58a1c80fd01a78e63437c7c6995d6cdd7f1e3a89393793552d

SHA512
f2907720de4a45adde7b9a9d02ed900d52f6d56c6c22c84c4b47782d1c621d7cc0ea1d936d7820255af3048ec5baa4f363b19e711f53c3dc8ff01f5f9ac29dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7881F684\skin.zip

Filesize
508KB

MD5
e7230d7304337bb3184cdd3fa3da051a

SHA1
59f0de7785874d02071a855df81f9ba6e6e8f0ec

SHA256
c3a8d7a715099ea60a3e6142f880e0be6737ed920f90bea391c75cb7625e513d

SHA512
7273a59f0486431003190a8d2d0dfc6799a4f28666ba144219afa5956742d15c1ba277a69d16e18891bfddffe562527714e2240fea8ce3498822d96b57672abd

Download Submit
\Users\Admin\AppData\Local\Temp\7z7881F684\nemu-downloader.exe

Filesize
3.2MB

MD5
c972d67cc128640dadceb178940080ce

SHA1
5a4a8a5eb7cd498397dfea938cf82372f27443f1

SHA256
17fadeae847897edce01db445632899da7314e05244327e4d88d828c8275be80

SHA512
725ecd661fb17681b2d26bac5f23de6d4503ccd004e8359ba6f772644e2b6b21f3ca4c9c2d7be8ae30881deabaf34419d2a5f9a15acdc447c89db9a9e81c71fe

Download Submit

Analysis

Sharing