73b6df0add9bc6b5792d274d316ecd70d636847db25ce6f3e63e77fb72369037

General

Target

595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
Size

28.7MB
MD5

a75bd304b668cfa64640b22e4c231349
SHA1

2a72f8bb89047305062d53337098c5e0573d9ff3
SHA256

595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e
SHA512

60f35560be97a8674c5c1e1916340655f619702dc6d95cfa32a4c7fad284e27b45a5dda5fc79a2ce0d8e0a87583ca1caa0ecae54ece10a1f5abdd5b9cdc41471
SSDEEP

786432:kxZADx6Nw9CJarloXOqTIzauR93oSQkNd:t6N9c2XRPC93oLkf

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 16 IoCs

pid	Process
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2136	netstat.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	netstat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2136	2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe	30
PID 2652 wrote to memory of 2136	2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe	30
PID 2652 wrote to memory of 2136	2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe	30
PID 2652 wrote to memory of 2136	2652	595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe	30

C:\Users\Admin\AppData\Local\Temp\595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe
"C:\Users\Admin\AppData\Local\Temp\595539b2009fdf8e53a409f7a21b779e7a670ca61f0a8dc216b226d753a54e6e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\netstat.exe
  netstat -an
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\ioSpecial.ini

Filesize
697B

MD5
e2eec9c3e22dee8983e0daa4ba93ad6a

SHA1
a3a4e655a72f9a47b472395fd02d2eb364ed91ed

SHA256
a00e3360bd9cad2d43efb63479ac40845487107b20ad2a835ff6ca303ddcda55

SHA512
9c6651bd00ffeb5223965966e0a0f6a9604061bccfb99ddb11e8fe3553d5e18ff867ed86d02021c297bd40ede1cdd4fd525ec85b884ddaf518e1e50ea29bf974

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\ioSpecial.ini

Filesize
369B

MD5
bbff464f9981a0e2ee8a62986547b132

SHA1
2796ed2914720bb9c6e3a8b93afb80a37073373c

SHA256
172577c3b748b386006a9d20b4b0d6a8c2d3f29176fccf15f75774b366e6ae47

SHA512
bb7e6ce83c0476bf008fc7b0078e0c69bf480cc61c7ab6d99e2528a379635ceb20f3089c1612ac0cc5863c82a2192e89722bbc82afab2ddfd8194a80627285bd

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6B7.tmp\spiceworksprocess.dll

Filesize
48KB

MD5
8b1adf175fa3cf7567a6f204b871b0cb

SHA1
07e0697e78bf4f03a1f5a071a82867c83e1d904c

SHA256
02b3327dbff567e4dd982fca38495542b73a438f96806b6e9bb09da56e5976e1

SHA512
368e200741d1fb2320a45b5f874de5bb1524c033efba376c23da765cd24da7ea4e592b6ed24a6333cf4b7fa1e36fca40c92bdf7b560ea1d802b784984fa4c3cd

Download Submit
memory/2652-30-0x00000000004E0000-0x00000000004ED000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing