cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5

General

Target

cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe
Size

854KB
MD5

5e1fb9afc29c8dfb357b46be649ab88f
SHA1

aa539b2ad8551f23b1d6adc9b967a62edd2be41d
SHA256

cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5
SHA512

8771b8191e91f96d22652feb0c0d98a2b0542b5e3eefc63334e1951d28e86e427dc501fca868685fe37d797da33a391a3ac926ecc89e9620a49f9da46eba470f
SSDEEP

24576:tYDoeMwkejuoLD0UU+RSmR7L342o4aEleqD:GdMErLjvsw3/haEdD

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anraabelsens\Hyposternal.udk	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2064	powershell.exe
2860	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2860	2064	powershell.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2064	332	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe	31
PID 332 wrote to memory of 2064	332	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe	31
PID 332 wrote to memory of 2064	332	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe	31
PID 332 wrote to memory of 2064	332	cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe	31
PID 2064 wrote to memory of 2860	2064	powershell.exe	34
PID 2064 wrote to memory of 2860	2064	powershell.exe	34
PID 2064 wrote to memory of 2860	2064	powershell.exe	34
PID 2064 wrote to memory of 2860	2064	powershell.exe	34
PID 2064 wrote to memory of 2860	2064	powershell.exe	34
PID 2064 wrote to memory of 2860	2064	powershell.exe	34

C:\Users\Admin\AppData\Local\Temp\cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe
"C:\Users\Admin\AppData\Local\Temp\cd39bffc74d996c25ba6b6edde8601677b6d248fc9adf77376a56e9283b653b5.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Penseful=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Contemnibly.Kal126';$Jades=$Penseful.SubString(39974,3);.$Jades($Penseful) "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Contemnibly.Kal126

Filesize
68KB

MD5
62c871e1284ff747c01b44202cc4a52c

SHA1
eb4f8109235b0cd3dd57ccdd48f44f0050dfc035

SHA256
c26c6d274fa7c270b83b68cb00527cd5bc1fc41985063adedd206784bcfade3a

SHA512
56c39f9524f906c4c69a70816fe0d07572ff2afdb8b224f1eb9a075a5c028f2603ba91ee38fb447749f897c972fd8d46e1eefa4fa8d1f2fb02b845bc30a5bb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Underskriftnavn.Lys

Filesize
341KB

MD5
6a37391af70efb133ad3a00a953d0f6e

SHA1
d33b8e218ee966d08c22e515678fa54e6940fc39

SHA256
d900511fed8ac202392cb367536359f266ae3d9de372794aec5181c86daaedec

SHA512
a29c2f8505ad97b6cd21087333a42387b365d28d3f7553e79a5ba140cb4044ae3ff4cd8420dce99fdaeb95ee282031d0a51ed1efb4c680ae19168619c2aaf12e

Download Submit
memory/2064-7-0x00000000742B1000-0x00000000742B2000-memory.dmp

Filesize
4KB

Download
memory/2064-9-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-8-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-11-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-10-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-14-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-16-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-17-0x0000000006550000-0x000000000C09D000-memory.dmp

Filesize
91.3MB

Download
memory/2064-18-0x00000000742B0000-0x000000007485B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-20-0x0000000000DF0000-0x0000000001E52000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing