153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536

General

Target

153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe
Size

627KB
MD5

342d7b2b1f3bf1be39496effcdd9ffd8
SHA1

c6f94540d29b679e3e57d4e0c8e9b4f356682f43
SHA256

153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536
SHA512

a939ff45f6d4b3c5fa4d0be54cbbc764ccb58b97553334293dc5ae16928def5ebae4816adff294ad0da831fc9b549aba6af4af2bcd2b99225b34a29423efd556
SSDEEP

12288:5rRo7TKXllTf+RbKDhsm1oDlOW5cJphWiJ1kIS+BrA:JC7TKXlFf62DhoDlO+gphZJmIS+hA

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2300	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Brachyprism255 = "%Hydragog% -windowstyle minimized $Irreproductive=(Get-ItemProperty -Path 'HKCU:\\Brefrekvensernes\\').Orthogonalize;%Hydragog% ($Irreproductive)"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1384	powershell.exe
2700	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 2700	1384	powershell.exe	32

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Detrainment90\strenuosity.pot	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1384	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
836	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1384	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1384	2300	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe	29
PID 2300 wrote to memory of 1384	2300	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe	29
PID 2300 wrote to memory of 1384	2300	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe	29
PID 2300 wrote to memory of 1384	2300	153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe	29
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 1384 wrote to memory of 2700	1384	powershell.exe	32
PID 2700 wrote to memory of 2620	2700	wab.exe	33
PID 2700 wrote to memory of 2620	2700	wab.exe	33
PID 2700 wrote to memory of 2620	2700	wab.exe	33
PID 2700 wrote to memory of 2620	2700	wab.exe	33
PID 2620 wrote to memory of 836	2620	cmd.exe	35
PID 2620 wrote to memory of 836	2620	cmd.exe	35
PID 2620 wrote to memory of 836	2620	cmd.exe	35
PID 2620 wrote to memory of 836	2620	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe
"C:\Users\Admin\AppData\Local\Temp\153c188cd936975cbc916b08b0b6d3d32d526e3e126f0843877bf3a44389d536.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized " $Tarsernes=Get-Content 'C:\Users\Admin\AppData\Local\Vandskellenes\Tramp\drejebnksvrktjets\Bulmes.Kol32';$Unlaced=$Tarsernes.SubString(6710,3);.$Unlaced($Tarsernes)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Brachyprism255" /t REG_EXPAND_SZ /d "%Hydragog% -windowstyle minimized $Irreproductive=(Get-ItemProperty -Path 'HKCU:\Brefrekvensernes\').Orthogonalize;%Hydragog% ($Irreproductive)"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Brachyprism255" /t REG_EXPAND_SZ /d "%Hydragog% -windowstyle minimized $Irreproductive=(Get-ItemProperty -Path 'HKCU:\Brefrekvensernes\').Orthogonalize;%Hydragog% ($Irreproductive)"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Vandskellenes\Tramp\drejebnksvrktjets\Barderede.Sek

Filesize
362KB

MD5
b3150777f2b9ccbb21078b4d4bb8a0de

SHA1
1f1a12a669e39676304b3b6c0973a4ed37a08c63

SHA256
1df56a2ce22679859461d6482b3825e5eb76b131ee92a5251db6770305f3c544

SHA512
2e77dc5917fece50b1480f18e01a3e76e1378b33fa51b53890bdb2449c1cbf13e02577a84fb232aa5972616f630e0c7f62a698eb6fc1277d1a6182e3eab7b6b1

Download Submit
C:\Users\Admin\AppData\Local\Vandskellenes\Tramp\drejebnksvrktjets\Bulmes.Kol32

Filesize
52KB

MD5
90341d474017dc14627004bc73bbd211

SHA1
e3e8c43d0406c96d2e55782c480fa93e85cb3884

SHA256
af1a6315e00b71ebf549faf7182f9185ea4bdbcf936afbbc047760ad250ab2a3

SHA512
a93a25f68c822e3b9f150908945ed1136762974c8c0b4a6145c9d6bea138e3d67ec89422fe5f91c92355fda59d721d5c277dacaad4434a2b642477e2af1228d8

Download Submit
\Users\Admin\AppData\Local\Temp\nseA6CB.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
memory/1384-15-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-14-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-17-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-16-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-20-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-13-0x0000000074201000-0x0000000074202000-memory.dmp

Filesize
4KB

Download
memory/1384-22-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1384-23-0x0000000006710000-0x000000000A422000-memory.dmp

Filesize
61.1MB

Download
memory/1384-24-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-25-0x0000000000690000-0x00000000016F2000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads