0ff8bee4e6a94db06262320774c0babf688c2f47192e62d5712738ac18f00c47

General

Target

Fish-Spoofer.exe
Size

19KB
MD5

5b26c7f570157e727ad879566d03233e
SHA1

1ddc10eee002147b02f6d3b6dcdc6de25a17319e
SHA256

7ffc6990f8c8482b2400354ce2f1839fbf74afcfe13b6613da56a6d854eefeb6
SHA512

1eddea9bcc8422c34879c888b3a38f0c069ff5de8e8b19c878e88dec48f5cd6929f0a2c5b0e49572af54986dcc78d697b4a9cdf41b3c45a55a7a1b2550e6486e
SSDEEP

384:ElADMr9qbL8j5ARr6RJYpWkyZ0bTE6YfEd3Y88XWnHVu:ElNAQSRuRaMkZbT40r8XWHY

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TKgXeEauRuFILLE\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\TKgXeEauRuFILLE"	map.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tiyjwmEvTibuk\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\tiyjwmEvTibuk"	map.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\usilhXOLMDxsoXSEVOGLIUT\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\usilhXOLMDxsoXSEVOGLIUT"	map.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kdrelBflbdXfpEFwZBBoEjsWLtvn\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\kdrelBflbdXfpEFwZBBoEjsWLtvn"	map.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HOQhgygENRNTyjq\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\HOQhgygENRNTyjq"	map.exe

Executes dropped EXE 5 IoCs

pid	Process
1140	map.exe
5056	map.exe
840	map.exe
864	map.exe
1172	map.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mapdrv.sys	Fish-Spoofer.exe
File created	C:\Windows\map.exe	Fish-Spoofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fish-Spoofer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3200	Fish-Spoofer.exe
3200	Fish-Spoofer.exe
3200	Fish-Spoofer.exe
3200	Fish-Spoofer.exe
3200	Fish-Spoofer.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
1140	map.exe
5056	map.exe
840	map.exe
864	map.exe
1172	map.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	Fish-Spoofer.exe
Token: SeLoadDriverPrivilege	1140	map.exe
Token: SeLoadDriverPrivilege	5056	map.exe
Token: SeLoadDriverPrivilege	840	map.exe
Token: SeLoadDriverPrivilege	864	map.exe
Token: SeLoadDriverPrivilege	1172	map.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1140	3200	Fish-Spoofer.exe	80
PID 3200 wrote to memory of 1140	3200	Fish-Spoofer.exe	80
PID 3200 wrote to memory of 5056	3200	Fish-Spoofer.exe	83
PID 3200 wrote to memory of 5056	3200	Fish-Spoofer.exe	83
PID 3200 wrote to memory of 840	3200	Fish-Spoofer.exe	86
PID 3200 wrote to memory of 840	3200	Fish-Spoofer.exe	86
PID 3200 wrote to memory of 864	3200	Fish-Spoofer.exe	89
PID 3200 wrote to memory of 864	3200	Fish-Spoofer.exe	89
PID 3200 wrote to memory of 1172	3200	Fish-Spoofer.exe	92
PID 3200 wrote to memory of 1172	3200	Fish-Spoofer.exe	92

C:\Users\Admin\AppData\Local\Temp\Fish-Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Fish-Spoofer.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\map.exe
  "C:\Windows\map.exe" C:\Windows\mapdrv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\map.exe
  "C:\Windows\map.exe" C:\Windows\mapdrv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\map.exe
  "C:\Windows\map.exe" C:\Windows\mapdrv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\map.exe
  "C:\Windows\map.exe" C:\Windows\mapdrv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\map.exe
  "C:\Windows\map.exe" C:\Windows\mapdrv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tiyjwmEvTibuk

Filesize
33KB

MD5
1898ceda3247213c084f43637ef163b3

SHA1
d04e5db5b6c848a29732bfd52029001f23c3da75

SHA256
4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b

SHA512
84c3ccc657f83725b24a20f83b87577603f580993920cc42d6da58648c6888d950fd19fbb8b404ce51a3eab674066c5cefe275763fbdb32e1ae1ba98097ab377

Download Submit
C:\Windows\map.exe

Filesize
134KB

MD5
9d4b543b8f15cc991961946649595566

SHA1
3b10c75dfd49303e29d380f199701e82da1f400d

SHA256
7cd36e94b2cbe1f9cdcf43dbbf725e79a6d95b51e0e1f2c1327ddf3812b2e4fa

SHA512
03fb0bb4f9688eb75162ca9cdc82ad76378fb67fb69abdef10aca8bd678fdb5acda1b81f9750137567a377aa61891f3d64545f962d2cf013fbd7c5713ce786f4

Download Submit
C:\Windows\mapdrv.sys

Filesize
3KB

MD5
bf7fe8993701d97706fe258fa3ba69b1

SHA1
e0240fd7ab9056bc95764621432f34857ed648dd

SHA256
4f7f5d4cf54079dbfac47d6bc08fc7c4d5ca03b4f5c09b3c998b8f6bd125d82a

SHA512
773e0bd04b3e9f9a33cee600b6c4f3d7117f04c80580ba2f96331dde1351d5fd76fe4217a40738f4240e67df3f12885d95638c367ec51843b08e41875212bc69

Download Submit
memory/3200-0-0x000000007453E000-0x000000007453F000-memory.dmp

Filesize
4KB

Download
memory/3200-1-0x0000000000F50000-0x0000000000F5C000-memory.dmp

Filesize
48KB

Download
memory/3200-2-0x0000000003470000-0x000000000347C000-memory.dmp

Filesize
48KB

Download
memory/3200-3-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/3200-4-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3200-5-0x000000007453E000-0x000000007453F000-memory.dmp

Filesize
4KB

Download
memory/3200-6-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3200-19-0x00000000066A0000-0x0000000006706000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads