67423d1fb9834094b62c66681b6284753f64b40b159494293362589e10bb896d

General

Target

af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe
Size

898KB
MD5

c02798b26bdaf8e27c1c48ef5de4b2c3
SHA1

bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615
SHA256

af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78
SHA512

b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4
SSDEEP

24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mx.redinbox.org
Port:
587
Username:
[email protected]
Password:
20100813125554samvu

Extracted

Credentials

Protocol: smtp
Host:
smtp.netzero.com
Port:
587
Username:
[email protected]
Password:
CaKewalk1!

Extracted

Credentials

Protocol: smtp
Host:
smtp.netzero.net
Port:
587
Username:
[email protected]
Password:
goombas

Extracted

Credentials

Protocol: smtp
Host:
winer.com.br
Port:
587
Username:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.sakai.zaq.ne.jp
Port:
587
Username:
[email protected]
Password:
rlaehgus5842

Extracted

Credentials

Protocol: smtp
Host:
smtp.frontier.com
Port:
587
Username:
[email protected]
Password:
horses4902

Extracted

Credentials

Protocol: smtp
Host:
smtp.netzero.net
Port:
587
Username:
[email protected]
Password:
ou8122!

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2264	clamer.exe
2844	lofsawd.exe
2580	qrtxe.exe

Loads dropped DLL 1 IoCs

pid	Process
2084	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Test Task17.job	lofsawd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lofsawd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtxe.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2084	2988	af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe	31
PID 2988 wrote to memory of 2084	2988	af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe	31
PID 2988 wrote to memory of 2084	2988	af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe	31
PID 2084 wrote to memory of 2264	2084	cmd.exe	33
PID 2084 wrote to memory of 2264	2084	cmd.exe	33
PID 2084 wrote to memory of 2264	2084	cmd.exe	33
PID 2264 wrote to memory of 2844	2264	clamer.exe	34
PID 2264 wrote to memory of 2844	2264	clamer.exe	34
PID 2264 wrote to memory of 2844	2264	clamer.exe	34
PID 2264 wrote to memory of 2844	2264	clamer.exe	34
PID 1968 wrote to memory of 2580	1968	taskeng.exe	36
PID 1968 wrote to memory of 2580	1968	taskeng.exe	36
PID 1968 wrote to memory of 2580	1968	taskeng.exe	36
PID 1968 wrote to memory of 2580	1968	taskeng.exe	36

C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe
"C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    clamer.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2844

C:\Windows\system32\taskeng.exe
taskeng.exe {9DB6FEDA-4DAE-4A57-8FFE-C50C3FB34E79} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\ProgramData\ionmosl\qrtxe.exe
  C:\ProgramData\ionmosl\qrtxe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
37B

MD5
28151380c82f5de81c1323171201e013

SHA1
ae515d813ba2b17c8c5ebdae196663dc81c26d3c

SHA256
bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

SHA512
46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
220B

MD5
565b1a2a6b97c44edac6f2f267c66060

SHA1
0981cf5ae5570c3dbefad77fbce15ea894a363b2

SHA256
0d2980bbb1473716bc72618a7159b7055e3ca8f680549c9ee256526335812797

SHA512
b4f2d12a0a499071eb16455ad1e0946dccaa54ad2304a66a103d2b224e543392f07dda71e73bbd5ea7b3dd26763e3860e103f160d184b693803b01d97b3ebc64

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

Filesize
453KB

MD5
a9f386515c3896a0a106940be362de47

SHA1
d1a9cf3c16555db4b2395d388995c2b13d2d683b

SHA256
12532d6bf0cdb5ea1cc0844e9ef73530456a337d5b73bb8d23e110fac46c3446

SHA512
7a2a4a6c7f9c426ff57066786892f4bbd7830f8c91985f1243abfd9148878345e83813eb09434b68b6616b76860d4163c1c7e32d4eb552953019fc8cb4c0a448

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads