49f9ac550d9df149caa708bd58d9886e6322a176b8ad723b8032ad5bc3ba9c84

General

Target

ESPLS-RFQ_2400282.exe
Size

841KB
MD5

516a26f5978b8c97c755dd1d4292ffb6
SHA1

6cf511da5aa396b7ff854a68869536aa6b2c55b5
SHA256

49f9ac550d9df149caa708bd58d9886e6322a176b8ad723b8032ad5bc3ba9c84
SHA512

637abedfeee38d1f6e6cacf536f84cb9f47e928c4914fedd8049a484594276f1ba4aa345fd688c63f3e41b330ba46a4e608ceb946f3aef865e14f1231067332d
SSDEEP

24576:gYDoeMwkejuoLDr9OUPepXIVVMVu3ciVdm:rdMErLgq9PMo3xm

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anraabelsens\Hyposternal.udk	ESPLS-RFQ_2400282.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2656	powershell.exe
2616	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2656 set thread context of 2616	2656	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ESPLS-RFQ_2400282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2656	2220	ESPLS-RFQ_2400282.exe	30
PID 2220 wrote to memory of 2656	2220	ESPLS-RFQ_2400282.exe	30
PID 2220 wrote to memory of 2656	2220	ESPLS-RFQ_2400282.exe	30
PID 2220 wrote to memory of 2656	2220	ESPLS-RFQ_2400282.exe	30
PID 2656 wrote to memory of 2616	2656	powershell.exe	33
PID 2656 wrote to memory of 2616	2656	powershell.exe	33
PID 2656 wrote to memory of 2616	2656	powershell.exe	33
PID 2656 wrote to memory of 2616	2656	powershell.exe	33
PID 2656 wrote to memory of 2616	2656	powershell.exe	33
PID 2656 wrote to memory of 2616	2656	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\ESPLS-RFQ_2400282.exe
"C:\Users\Admin\AppData\Local\Temp\ESPLS-RFQ_2400282.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Stalddr=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Maskinafdelingschefernes.Bad';$Wordman=$Stalddr.SubString(68868,3);.$Wordman($Stalddr) "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Ktteriet.Man

Filesize
325KB

MD5
86adff472066cd6216b3e0af00b71a04

SHA1
dc2dcf51188addc88bd97aed372afad0144943ed

SHA256
645aa76c2bb7dbdef7f7fbcf02c090d8b6cc3c28781f7f91ef8eaf218e16e214

SHA512
bd4f16a778bafc5d88e29e52eb68b37e8fea9cb045e9feae4967b235a080e80d7329dfcdb0b5ddc05bc7e092c25ecd7e300bcb9c311d52daa3de5c26c8168f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Maskinafdelingschefernes.Bad

Filesize
67KB

MD5
d58525967b589107e754197535c06a42

SHA1
7c47a1a561652ea86d18f54227aec08781ffbf54

SHA256
e4cae71926618f28c3c1e81e7f132f4c3581971a12673fafc1c67d0db5921211

SHA512
35c3ac779cbe0a50ae0f3e00a7710b52565bae267af9f08b55d43ee6ba300be766e42843a9f2f20540bebb74c45e06f8d14903a416280fd705cd29ffe996dde1

Download Submit
memory/2616-19-0x0000000000DE0000-0x0000000001E42000-memory.dmp

Filesize
16.4MB

Download
memory/2656-7-0x00000000738B1000-0x00000000738B2000-memory.dmp

Filesize
4KB

Download
memory/2656-8-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-9-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-10-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-11-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-14-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-16-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-17-0x00000000067B0000-0x0000000007899000-memory.dmp

Filesize
16.9MB

Download
memory/2656-18-0x00000000738B0000-0x0000000073E5B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing