General

  • Target

    auto-creamapi.exe

  • Size

    4.9MB

  • Sample

    240812-nnfacaygrp

  • MD5

    2b4c2827a5e0afa08d55014d5d9f3976

  • SHA1

    6b182cda0dcb1511d0cf426eaa0126de2066af92

  • SHA256

    7f6e8ac3c2747443f91c0c2c7c7e3ca7335ba9090275b70619b5903316d537e0

  • SHA512

    f168c3123f1bc7a5d11b09332be13c8371ad2ad3fa9a8811727505212123d73d0d150924a7aa1386475048e69516b1b266633760c5403417d572858bb09a87f7

  • SSDEEP

    98304:siR6LPHMssoiHhKbWiVbMqhVvu8o9pcLFwiS:siUzM0iHhWWiVbMOVvu8ovcLFwiS

Malware Config

Targets

    • Target

      auto-creamapi.exe

    • Size

      4.9MB

    • MD5

      2b4c2827a5e0afa08d55014d5d9f3976

    • SHA1

      6b182cda0dcb1511d0cf426eaa0126de2066af92

    • SHA256

      7f6e8ac3c2747443f91c0c2c7c7e3ca7335ba9090275b70619b5903316d537e0

    • SHA512

      f168c3123f1bc7a5d11b09332be13c8371ad2ad3fa9a8811727505212123d73d0d150924a7aa1386475048e69516b1b266633760c5403417d572858bb09a87f7

    • SSDEEP

      98304:siR6LPHMssoiHhKbWiVbMqhVvu8o9pcLFwiS:siUzM0iHhWWiVbMOVvu8ovcLFwiS

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks