af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

General

Target

gawdth.exe
Size

898KB
MD5

c02798b26bdaf8e27c1c48ef5de4b2c3
SHA1

bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615
SHA256

af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78
SHA512

b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4
SSDEEP

24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

clamer.exelofsawd.exenkhhor.exe

pid process

2428 clamer.exe
2804 lofsawd.exe
2612 nkhhor.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2284 cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

lofsawd.exe

description ioc process

File created C:\Windows\Tasks\Test Task17.job lofsawd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2428	clamer.exe
2804	lofsawd.exe
2612	nkhhor.exe

pid	process
2284	cmd.exe

description	ioc	process
File created	C:\Windows\Tasks\Test Task17.job	lofsawd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lofsawd.exenkhhor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lofsawd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkhhor.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

gawdth.execmd.execlamer.exetaskeng.exe

description	pid	process	target process
PID 2104 wrote to memory of 2284	2104	gawdth.exe	cmd.exe
PID 2104 wrote to memory of 2284	2104	gawdth.exe	cmd.exe
PID 2104 wrote to memory of 2284	2104	gawdth.exe	cmd.exe
PID 2284 wrote to memory of 2428	2284	cmd.exe	clamer.exe
PID 2284 wrote to memory of 2428	2284	cmd.exe	clamer.exe
PID 2284 wrote to memory of 2428	2284	cmd.exe	clamer.exe
PID 2428 wrote to memory of 2804	2428	clamer.exe	lofsawd.exe
PID 2428 wrote to memory of 2804	2428	clamer.exe	lofsawd.exe
PID 2428 wrote to memory of 2804	2428	clamer.exe	lofsawd.exe
PID 2428 wrote to memory of 2804	2428	clamer.exe	lofsawd.exe
PID 2652 wrote to memory of 2612	2652	taskeng.exe	nkhhor.exe
PID 2652 wrote to memory of 2612	2652	taskeng.exe	nkhhor.exe
PID 2652 wrote to memory of 2612	2652	taskeng.exe	nkhhor.exe
PID 2652 wrote to memory of 2612	2652	taskeng.exe	nkhhor.exe

C:\Users\Admin\AppData\Local\Temp\gawdth.exe
"C:\Users\Admin\AppData\Local\Temp\gawdth.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    clamer.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2804

C:\Windows\system32\taskeng.exe
taskeng.exe {59D15247-57E8-4207-A0DB-06E70ABF0333} S-1-5-21-2958949473-3205530200-1453100116-1000:WHMFPZKA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\ProgramData\lbqb\nkhhor.exe
  C:\ProgramData\lbqb\nkhhor.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
37B

MD5
28151380c82f5de81c1323171201e013

SHA1
ae515d813ba2b17c8c5ebdae196663dc81c26d3c

SHA256
bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

SHA512
46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
216B

MD5
b52caae8b600a274af8445f8dcf1d368

SHA1
9a1074b3a1dfc37279ec662838cd3e4c2179576d

SHA256
59b434649185342565b93638d9267e7e9aea84313db175c4685e5f378aa4f2c3

SHA512
c8af479bbf26bedc1a8326dd461a8a599d70743091119c0d62232f0ad0d2c7b737ac83b2ed3f6e1ca7969ef899d82998f35f7b620d156ad0913141574fa0a56c

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

Filesize
453KB

MD5
a9f386515c3896a0a106940be362de47

SHA1
d1a9cf3c16555db4b2395d388995c2b13d2d683b

SHA256
12532d6bf0cdb5ea1cc0844e9ef73530456a337d5b73bb8d23e110fac46c3446

SHA512
7a2a4a6c7f9c426ff57066786892f4bbd7830f8c91985f1243abfd9148878345e83813eb09434b68b6616b76860d4163c1c7e32d4eb552953019fc8cb4c0a448

Download Submit

Analysis

Sharing