10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef

General

Target

10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
Size

15.6MB
MD5

75aa53de2501960561a57120eb763b27
SHA1

f3817f78461a1b4cc50ef049b77aec5faa07ab64
SHA256

10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef
SHA512

6d180b6d1cf82ba0583f5b68c3ee41055839384b4cd227de325b839d61f6e79a4cf7afef2507b90cdc3b6bcc9911a2725fb809098e6eab0036cf982367bcf1fd
SSDEEP

393216:ExsEPrC0Alz1Pb4Towz/9F+vKQyzA3Bo8CL6yNJ77ykqSFIhT:EyqrwxjUowM9KA3Bo8Cd7/q3T

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1192-0-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-5.dat	upx
behavioral2/memory/1912-7-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1192-10-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-17-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-18-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-21-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-22-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-23-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-26-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-30-0x0000000000400000-0x0000000000D49000-memory.dmp	upx
behavioral2/memory/1912-33-0x0000000000400000-0x0000000000D49000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\Z:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\B:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\J:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\M:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\P:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\R:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\S:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\W:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\Y:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\H:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\L:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\O:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\U:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\V:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\G:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\N:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\T:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\K:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\X:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\A:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\E:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
File opened (read-only)	\??\I:	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
1912	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1912	1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe	88
PID 1192 wrote to memory of 1912	1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe	88
PID 1192 wrote to memory of 1912	1192	10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe	88

C:\Users\Admin\AppData\Local\Temp\10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
"C:\Users\Admin\AppData\Local\Temp\10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\µÛÍõÃÔÊ§Î¢¶Ë\10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
  C:\µÛÍõÃÔÊ§Î¢¶Ë\10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f33a09333b657bbdfaa4ccbecff302fc.tmp

Filesize
16B

MD5
1b576b71cc87efa5b7369d37543e45bf

SHA1
14befd08c2e58d4cfca0fd09fb62099d4622a22a

SHA256
a92fade26263b12c2da01da6fd40d3d9b7bb5acbdf5a96b62727c1160e03d28d

SHA512
cfc151181ac925232e8ae1214ee07e500f9d2beed16a60e0fb291f7668c84971d4f8a1e2b16e7d37b4df2cd2aa0931b835a7c3fa8fcb686c11f17bdfbac98a41

Download Submit
C:\µÛÍõÃÔÊ§Î¢¶Ë\10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef.exe

Filesize
15.6MB

MD5
75aa53de2501960561a57120eb763b27

SHA1
f3817f78461a1b4cc50ef049b77aec5faa07ab64

SHA256
10d160594e755f56c7e5423f0fd79f9a1c477a942f0ae25d324bcbc87cc2e7ef

SHA512
6d180b6d1cf82ba0583f5b68c3ee41055839384b4cd227de325b839d61f6e79a4cf7afef2507b90cdc3b6bcc9911a2725fb809098e6eab0036cf982367bcf1fd

Download Submit
memory/1192-0-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1192-8-0x00000000004AC000-0x00000000004AD000-memory.dmp

Filesize
4KB

Download
memory/1192-10-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-17-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-7-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-18-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-21-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-22-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-23-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-26-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-30-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download
memory/1912-33-0x0000000000400000-0x0000000000D49000-memory.dmp

Filesize
9.3MB

Download

Analysis

Sharing