f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65

General

Target

f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe
Size

5.8MB
MD5

b4fb5aa2330d0e6b30d9507b7412498d
SHA1

d4c9188e7b895892220905b5b8d19c8d0dffb98c
SHA256

f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65
SHA512

a539b26a0a2edb6684b6e7471033529ec121ee894334b32d8a42e78125c30bbbf78d16b2ffb9f3ee895f1a60c482ec2a3a49bd235e292ecde9a133cbb78b67ff
SSDEEP

98304:tnNpKxwTEJUNYQ5N06yhs/4t7kp54cpU01TB1RRXC+1earotrJeSUXL:FHEwgO4rTt7k8h01TjRNC+AnrJeTXL

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2548	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp

Loads dropped DLL 4 IoCs

pid	Process
3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe
2548	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp
2548	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp
2548	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30
PID 3008 wrote to memory of 2548	3008	f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe	30

C:\Users\Admin\AppData\Local\Temp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe
"C:\Users\Admin\AppData\Local\Temp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\is-N3UQU.tmp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N3UQU.tmp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp" /SL5="$4010A,5794119,54272,C:\Users\Admin\AppData\Local\Temp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-MKRIR.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MKRIR.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-N3UQU.tmp\f463293ec0bbb2db5a64d577615a6a70893634ab84b656bba5982888318d9e65.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
memory/2548-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2548-19-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/2548-25-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2548-24-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/3008-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3008-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3008-22-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing