fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d

General

Target

fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe
Size

10.5MB
MD5

3d0d21bb14b9b2c32b8c48ffc0129f43
SHA1

bbe5f11930fc85fecefee72ed503cab2e0060c39
SHA256

fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d
SHA512

f448780d564cc3061df35a687177da60d486010928fe923f58a38b8db1c78c6d67d46c1fdcad95c0e68765e7fe97204333cd4f707fa9c37de364a7c3cfec57bb
SSDEEP

196608:p9tqSSJ7PbDdh0HtQba8z1sjzkAilU4I4:pu5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30
PID 1484 wrote to memory of 2904	1484	fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe	30

C:\Users\Admin\AppData\Local\Temp\fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe
"C:\Users\Admin\AppData\Local\Temp\fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe
  "C:\Users\Admin\AppData\Local\Temp\fd6c066ae29014303ec1c1c972d886d4dea02a3aca240d3bd435ca39f307a36d.exe" --parent-installer-process-id=1484 --run-as-admin --setup-cmd-line="fake_browser_arc --abt-config-resource-file=\"C:\Users\Admin\AppData\Local\Temp\abt_config_resource\" --abt-update-path=\"C:\Users\Admin\AppData\Local\Temp\e209b21d-802f-4161-800e-e1ddfd482442.tmp\" --brand-name=yandex --browser-present=none --distr-info-file=\"C:\Users\Admin\AppData\Local\Temp\distrib_info\" --installer-brand-id=yandex --installer-partner-id=exp_firstscreen_2 --make-browser-default-after-import --progress-window=197024 --send-statistics --testids=1045949 --variations-update-path=\"C:\Users\Admin\AppData\Local\Temp\de01ed08-1054-43f3-8ebd-1d3c2cf0c1d5.tmp\" --verbose-logging"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabC278.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
16KB

MD5
6657a1ab8ad5d86ee60a9f08b1a47130

SHA1
d8ddabeb3df78ff81e1b70c74b19fad9c2563f05

SHA256
fab5f5b38be4a100c74c900122ec1bf7531e58447a9ca46f1e70b57690377e5f

SHA512
1545d174767421fa7a8032bdcbb3016f2c31458e6ca2404b3dcd4f87fcd0aed563f2c4fb7cf1d07657e50c6e61ef26cd1dbd6086dc0e318239f0b0b8d3ff5153

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
21KB

MD5
61ec5ff6c1891db56d252706c9e388f4

SHA1
c47488d8d61a5bd7e17b9305d48b49c8396abbd8

SHA256
1170415e7b6e7b15b2ef03af2d2896965e1f78820480ec71afe4a0de94939c58

SHA512
4facd7d898675c7d2526b49c40de622642880b781d3819c799e247516ad6626cd95944036981d3d94044271fa4cf2dfcac111d62e53e1b808d980059b4072737

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
8KB

MD5
41bb9601b087789657c6697613850d6c

SHA1
438885ff86b8bd6356558f378a2fdf9e7670d692

SHA256
0f5d316e0130229e3f7e3d16587c2dadf3b764deeb7b9bc688011250daad8e73

SHA512
3c5e5edcb802f74d4df4359b10ce776771f0c7b11c8044e0b1b71b8fcc85171610d6a428014fb3a1c756db09397891ee1843c44879475940df37a63903b99964

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
6f65b665d283fa8b1f0f78576aafaf61

SHA1
c0e2e98499d869a7dcc8a0016f5343fe4031f383

SHA256
029b0e8ae37c30a8cec5eba1453289c35a6f02c169a8aec7d360453b974c35b0

SHA512
e9f472bc234e75d44ee2c34544f676ea57d4a72b2ef8b705362776b0190da684643b37cc0f5633e2c4af9bbc2dc92392ff91a7caad743924b75ce1def2f0cf5e

Download Submit

Analysis

Sharing