1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e

General

Target

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
Size

70.3MB
MD5

34685447de7a88a522e09b360da83bb8
SHA1

d7a051403a980d484bc4e6be11491c7d27b7c6b1
SHA256

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e
SHA512

ab29904572ecf226832aac8ecf3ad2e0d5f24c1292b25b3af67741352aa428c008b875447f5a61fd03974ba6ef0433a22e4f11d44efb3b21ef5dd9f9d3972eb8
SSDEEP

6144:9ykTQp8xurN4JlU94SyTKJPpTHf3zZOckmhrK:9JTQp8AiJl6+YxzfDZLK

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2692 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

WA8L13tOjD.exe

pid process

2732 WA8L13tOjD.exe

pid	process
2692	powershell.exe

pid	process
2732	WA8L13tOjD.exe

Loads dropped DLL 6 IoCs

Processes:

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exeWerFault.exe

pid	process
3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
1792	WerFault.exe
1792	WerFault.exe
1792	WerFault.exe
1792	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2692 powershell.exe

pid	process
2692	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
Token: SeDebugPrivilege	2692	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exeWA8L13tOjD.exe

description	pid	process	target process
PID 3036 wrote to memory of 2692	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	powershell.exe
PID 3036 wrote to memory of 2692	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	powershell.exe
PID 3036 wrote to memory of 2692	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	powershell.exe
PID 3036 wrote to memory of 2692	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	powershell.exe
PID 3036 wrote to memory of 2732	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	WA8L13tOjD.exe
PID 3036 wrote to memory of 2732	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	WA8L13tOjD.exe
PID 3036 wrote to memory of 2732	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	WA8L13tOjD.exe
PID 3036 wrote to memory of 2732	3036	1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe	WA8L13tOjD.exe
PID 2732 wrote to memory of 1792	2732	WA8L13tOjD.exe	WerFault.exe
PID 2732 wrote to memory of 1792	2732	WA8L13tOjD.exe	WerFault.exe
PID 2732 wrote to memory of 1792	2732	WA8L13tOjD.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe
"C:\Users\Admin\AppData\Local\Temp\1164a8f550cdcca584fbef5b09a9acb89fa79fbde89a66e92e1b45dcaa982c8e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABiAHUAeABMAGYAbAA0AEQAMQBHAFwAVwBBADgATAAxADMAdABPAGoARAAuAGUAeABlACcA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\buxLfl4D1G\WA8L13tOjD.exe
  "C:\Users\Admin\AppData\Local\Temp\buxLfl4D1G\WA8L13tOjD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2732 -s 44
    3⤵
    - Loads dropped DLL
    PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\buxLfl4D1G\WA8L13tOjD.exe

Filesize
2.2MB

MD5
21506ae1a222c3862c04d187b07ed714

SHA1
c70d79f32b962bf2e7e7901034aaedd8f2e71e35

SHA256
267e274b75ba1c49847eb93d95be90b6382768926e9c3674d115c21c3cc6f2c4

SHA512
351b4739f56820e271887d953ce1fdf68e19c11e84db9325e6f03866c0fc0ec1f6072db03a4013aa914f21990367fc207bfa0f9c41452553d5960881046a034f

Download Submit
memory/2692-13-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2692-14-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2692-12-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2692-11-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2692-10-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2692-9-0x000000006F7E1000-0x000000006F7E2000-memory.dmp

Filesize
4KB

Download
memory/3036-5-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-4-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/3036-3-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/3036-2-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-15-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-1-0x0000000000F50000-0x000000000559C000-memory.dmp

Filesize
70.3MB

Download
memory/3036-28-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads