f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131

General

Target

f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
Size

8.0MB
MD5

0cc09792c4e0ac345a21cb89238251ff
SHA1

76bbadad2c768d56288745f2baf32345f49dc630
SHA256

f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131
SHA512

cdb3bdabb10be88655eee9ec51f97db513adb6f7f48da6cb9d48182f07dd31585db138190ba12560118e871edbad0e0da1d7317118993e8175b140ce6018c93b
SSDEEP

196608:zrpWV8lOtCU3sOAWQnTrpUC5ON+pkb/56AhDk5q:vCmOkuBETrSl0SK5q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2068	sihost.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
2068	sihost.exe
2068	sihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
2068	sihost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
2068	sihost.exe
2068	sihost.exe
2068	sihost.exe
2068	sihost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2068	1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe	30
PID 1736 wrote to memory of 2068	1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe	30
PID 1736 wrote to memory of 2068	1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe	30
PID 1736 wrote to memory of 2068	1736	f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe	30

C:\Users\Admin\AppData\Local\Temp\f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe
"C:\Users\Admin\AppData\Local\Temp\f3cfbadd4b07a92e7116e199dd9f6dd03adf85f3cc38290cccd5880db9cd0131.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\sihost.exe
  "C:\Users\Admin\AppData\Local\Temp\sihost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\sihost.exe

Filesize
8.0MB

MD5
a8a14a764e1196ee653d0b24b4dda366

SHA1
c702e3493f97d759a8e6cd0526b11a0c65a93e10

SHA256
c3652a9c97ea8d45a77c311e570059af0542f9929e6318f064669f0f92aa5843

SHA512
5e12ed98c683f691a4b2c723d88404cf3aecdf403c1f954305cd4e64f990c2997d08140c6162f6e4a7cadb2cc2d93770605b04ee2e7bd406cb4de971523b5b80

Download Submit
memory/1736-28-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1736-35-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1736-8-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1736-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1736-10-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1736-11-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1736-13-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1736-15-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1736-18-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1736-20-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1736-23-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1736-25-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1736-0-0x000000000041D000-0x00000000008AE000-memory.dmp

Filesize
4.6MB

Download
memory/1736-3-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1736-30-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1736-33-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1736-36-0x0000000000400000-0x00000000010B8000-memory.dmp

Filesize
12.7MB

Download
memory/1736-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1736-47-0x000000000041D000-0x00000000008AE000-memory.dmp

Filesize
4.6MB

Download
memory/2068-55-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2068-50-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2068-52-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2068-62-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2068-60-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2068-57-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2068-67-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2068-65-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2068-72-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2068-70-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing