2e43c0fcc6c3b6ca8f1b80cfbeb47ee814a35a54fefb0249145e64112b19a09b

General

Target

d699a2189671acafeba1b982369dab80N.exe
Size

120KB
MD5

d699a2189671acafeba1b982369dab80
SHA1

e4ce9b0075148287958a0fd41ee071cdab298103
SHA256

2e43c0fcc6c3b6ca8f1b80cfbeb47ee814a35a54fefb0249145e64112b19a09b
SHA512

a9e9d1b71a0956a871bdc0b2566b7a23f7e196f5360a848708b41cefbc5cf82770c5b65fbff71531b628898ab117ce3235712913c920c7917b31c8a8ce357747
SSDEEP

1536:bcCWp99NqoFoPEZiWl/M7VO9nwF0OOi4DH0fOhjz0cZ44mjD9r823F4:Cdo74iI07gVwFBF4DkOGi/mjRrz3C

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	d699a2189671acafeba1b982369dab80N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d699a2189671acafeba1b982369dab80N.exe

Executes dropped EXE 2 IoCs

pid	Process
3000	Dmbcen32.exe
2140	Dpapaj32.exe

Loads dropped DLL 7 IoCs

pid	Process
2996	d699a2189671acafeba1b982369dab80N.exe
2996	d699a2189671acafeba1b982369dab80N.exe
3000	Dmbcen32.exe
3000	Dmbcen32.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File created	C:\Windows\SysWOW64\Dmbcen32.exe	d699a2189671acafeba1b982369dab80N.exe
File opened for modification	C:\Windows\SysWOW64\Dmbcen32.exe	d699a2189671acafeba1b982369dab80N.exe
File created	C:\Windows\SysWOW64\Fikbiheg.dll	d699a2189671acafeba1b982369dab80N.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Dmbcen32.exe
File created	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2140	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d699a2189671acafeba1b982369dab80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	d699a2189671acafeba1b982369dab80N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d699a2189671acafeba1b982369dab80N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d699a2189671acafeba1b982369dab80N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	d699a2189671acafeba1b982369dab80N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	d699a2189671acafeba1b982369dab80N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikbiheg.dll"	d699a2189671acafeba1b982369dab80N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmbcen32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3000	2996	d699a2189671acafeba1b982369dab80N.exe	31
PID 2996 wrote to memory of 3000	2996	d699a2189671acafeba1b982369dab80N.exe	31
PID 2996 wrote to memory of 3000	2996	d699a2189671acafeba1b982369dab80N.exe	31
PID 2996 wrote to memory of 3000	2996	d699a2189671acafeba1b982369dab80N.exe	31
PID 3000 wrote to memory of 2140	3000	Dmbcen32.exe	32
PID 3000 wrote to memory of 2140	3000	Dmbcen32.exe	32
PID 3000 wrote to memory of 2140	3000	Dmbcen32.exe	32
PID 3000 wrote to memory of 2140	3000	Dmbcen32.exe	32
PID 2140 wrote to memory of 2156	2140	Dpapaj32.exe	33
PID 2140 wrote to memory of 2156	2140	Dpapaj32.exe	33
PID 2140 wrote to memory of 2156	2140	Dpapaj32.exe	33
PID 2140 wrote to memory of 2156	2140	Dpapaj32.exe	33

C:\Users\Admin\AppData\Local\Temp\d699a2189671acafeba1b982369dab80N.exe
"C:\Users\Admin\AppData\Local\Temp\d699a2189671acafeba1b982369dab80N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\Dmbcen32.exe
  C:\Windows\system32\Dmbcen32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\Dpapaj32.exe
    C:\Windows\system32\Dpapaj32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 144
      4⤵
      Loads dropped DLL
      Program crash
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dmbcen32.exe

Filesize
120KB

MD5
ad433e39f6d9f03aad428776dfbf2ac5

SHA1
f6a355b7c1a112f4a5fc4b08a4b6a719afce908f

SHA256
5ad69e59b03d2c97990dafa6b4c61d45b44f870c2f85fe313ed0cf1c927ccd55

SHA512
21d4ca467b2fb0ce6519f2144564cd50a236397b9a79ac1c11a9d6d26d1eb01d90af0dab073f88c934ac1144dc8d3ebde0864a8fce60c1d8431ee70f0c9ff6dc

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
120KB

MD5
b9574fc3a6a0caf19cfd6f1699be5cef

SHA1
bb99d96d843b1f1406f0729d99beaae6d1e3b0a5

SHA256
e9fff00695df38ba25104d5b960f9de8726d0123befe6fbb6f97fa930c5b62e5

SHA512
6421d388d4109ef7f4266f068c278d9b5122aa95a1d0f723f8c2e6cb1a6dc47d5a94a541c3cc6adb99695daa8d5dcd80199abb8d6b5f40662b31fac685c4e013

Download Submit
memory/2140-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-18-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/2996-17-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/2996-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads