5f227a96e12db3cb3d4f39028e7ee99526e7704301e25bb77fedf478a99f2739

General

Target

Loader 3.0.exe
Size

147KB
MD5

ff4cd364323fc2048c35783a38070aef
SHA1

4736172dd07a3a196343b94dd56b4e4edc0f2bce
SHA256

6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7
SHA512

c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961
SSDEEP

1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT

Score

9^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

602A.tmp

pid process

1800 602A.tmp
Executes dropped EXE 1 IoCs

Processes:

602A.tmp

pid process

1800 602A.tmp
Loads dropped DLL 1 IoCs

Processes:

Loader 3.0.exe

pid process

1204 Loader 3.0.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

Processes:

Loader 3.0.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini	Loader 3.0.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini	Loader 3.0.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Loader 3.0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp"	Loader 3.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp"	Loader 3.0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

602A.tmp

pid process

1800 602A.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

602A.tmpcmd.exeLoader 3.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	602A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader 3.0.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

Loader 3.0.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop	Loader 3.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallpaperStyle = "10"	Loader 3.0.exe

Modifies registry class 5 IoCs

Processes:

Loader 3.0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC\ = "Jw5Jgl9mC"	Loader 3.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon	Loader 3.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC	Loader 3.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon\ = "C:\\ProgramData\\Jw5Jgl9mC.ico"	Loader 3.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC	Loader 3.0.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Loader 3.0.exe

pid	process
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe
1204	Loader 3.0.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

602A.tmp

pid	process
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp
1800	602A.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Loader 3.0.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeDebugPrivilege	1204	Loader 3.0.exe
Token: 36	1204	Loader 3.0.exe
Token: SeImpersonatePrivilege	1204	Loader 3.0.exe
Token: SeIncBasePriorityPrivilege	1204	Loader 3.0.exe
Token: SeIncreaseQuotaPrivilege	1204	Loader 3.0.exe
Token: 33	1204	Loader 3.0.exe
Token: SeManageVolumePrivilege	1204	Loader 3.0.exe
Token: SeProfSingleProcessPrivilege	1204	Loader 3.0.exe
Token: SeRestorePrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSystemProfilePrivilege	1204	Loader 3.0.exe
Token: SeTakeOwnershipPrivilege	1204	Loader 3.0.exe
Token: SeShutdownPrivilege	1204	Loader 3.0.exe
Token: SeDebugPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeBackupPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe
Token: SeSecurityPrivilege	1204	Loader 3.0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Loader 3.0.exe602A.tmp

description	pid	process	target process
PID 1204 wrote to memory of 1800	1204	Loader 3.0.exe	602A.tmp
PID 1204 wrote to memory of 1800	1204	Loader 3.0.exe	602A.tmp
PID 1204 wrote to memory of 1800	1204	Loader 3.0.exe	602A.tmp
PID 1204 wrote to memory of 1800	1204	Loader 3.0.exe	602A.tmp
PID 1204 wrote to memory of 1800	1204	Loader 3.0.exe	602A.tmp
PID 1800 wrote to memory of 1600	1800	602A.tmp	cmd.exe
PID 1800 wrote to memory of 1600	1800	602A.tmp	cmd.exe
PID 1800 wrote to memory of 1600	1800	602A.tmp	cmd.exe
PID 1800 wrote to memory of 1600	1800	602A.tmp	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe
"C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\ProgramData\602A.tmp
  "C:\ProgramData\602A.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\602A.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\CCCCCCCCCCC

Filesize
129B

MD5
e2a7530362fbb20a37045fd2a0fb0722

SHA1
4b9fc157272b8098a84fb5139c9ca4ad7b961e56

SHA256
022cc1c123a6f60b7f8093586caed599f790d7e7c332b933b9afb23c4d7e8f93

SHA512
65d90862d119c62e2d978e6e13b486c30243cac37267097a70446c036c50492da72b5cbda009993ad9458c502621bcffc366fe7db5f9530753396bd1999d280b

Download Submit
C:\Jw5Jgl9mC.README.txt

Filesize
1KB

MD5
8b28296a2c168d86adbafc888d0f95f0

SHA1
49d6b109bf24f39c2c0f62c0796b8693c0bd99e5

SHA256
7b3daacf846fe79840647e67d9c5226a7fda47d5b32c24d874654e8ff78ffcc9

SHA512
b0f0e0a6f2962250c3b9f87637854756e7a0fcde561aae14654d0dcd1e1013876442c0354e41c5bc8e3ef57f170ac2073874ff22fdc5656f62f930350f9df6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDD

Filesize
147KB

MD5
79a5837c047212dadc7fe19bc7dce967

SHA1
ec707d83066b05eac581ef5f5fe4d368dfdc0055

SHA256
c41d3d8d300223a2e1e18fc96b4897b1b4ecb7bebd97c6f20678b45fe2d32c22

SHA512
e001466c7225e028ee0a7fbf702554c5eb2c512c001dd5e7e469c29b0bc8dc7e1926d3bd5e89c4889090d93692bf50a0f233f5b755f5c5d927d1b010f1c5f0ab

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\GGGGGGGGGGG

Filesize
129B

MD5
d303aa6eaa284e63a5718ea33a14c195

SHA1
51051b2f580ee6edbd806bbfd76ce9aba660871a

SHA256
19fc36f4e9fbc13c174828ef268e43fcb6e5b137d68070c5026146a8e7f6afdb

SHA512
8a731225726017c078fa19d16bea18011543de57faff6f6752f1e4401b39593a361f180ce55c49d319beea4f2519c387f00c39f0d976a1d5c6eb4561481f47ac

Download Submit
\ProgramData\602A.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/1204-0-0x0000000000C70000-0x0000000000CB0000-memory.dmp

Filesize
256KB

Download
memory/1800-867-0x0000000002030000-0x0000000002070000-memory.dmp

Filesize
256KB

Download
memory/1800-870-0x000000007EF20000-0x000000007EF21000-memory.dmp

Filesize
4KB

Download
memory/1800-869-0x000000007EF80000-0x000000007EF81000-memory.dmp

Filesize
4KB

Download
memory/1800-868-0x0000000002030000-0x0000000002070000-memory.dmp

Filesize
256KB

Download
memory/1800-866-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/1800-900-0x000000007EF60000-0x000000007EF61000-memory.dmp

Filesize
4KB

Download
memory/1800-899-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads