8cd9b79f750139d935e4981e0968b0ca5a212f3d6e04471e7cbfcea2fa9b195c

General

Target

dfsetup30.exe
Size

994KB
MD5

a933a21a48b4972525a054b1d9e5fcdc
SHA1

6d4009b79987d516ea808049d399dd8fa194dbe2
SHA256

d4304c6ef944a682252a7694643f7297ebd46a0daf3b2ef2b106f36e907acab7
SHA512

78b6629c94e15107ce8d2e20586ac57e4bf913e41ba76d6577bb4de8f3e31c5ed0af734c637b8c7da9899a911cf67bf7e260af51f389705604db68a1bdb3c793
SSDEEP

24576:v2UpvKwZm9kvOfpYb8ZXNx98E5Y1bNUsk0o8YaXag:v2uiwMkvQk8l98Q4S1/aV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1284	dfsetup30.tmp

Loads dropped DLL 4 IoCs

pid	Process
2064	dfsetup30.exe
1284	dfsetup30.tmp
1284	dfsetup30.tmp
1284	dfsetup30.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DupFiles\unins000.dat	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-NS6KM.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-RNEMU.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-M918E.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-JTOV5.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-VNAUC.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-FEA88.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-E893S.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-9VN1A.tmp	dfsetup30.tmp
File opened for modification	C:\Program Files (x86)\DupFiles\unins000.dat	dfsetup30.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfsetup30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfsetup30.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 2064 wrote to memory of 1284	2064	dfsetup30.exe	30
PID 1284 wrote to memory of 2800	1284	dfsetup30.tmp	32
PID 1284 wrote to memory of 2800	1284	dfsetup30.tmp	32
PID 1284 wrote to memory of 2800	1284	dfsetup30.tmp	32
PID 1284 wrote to memory of 2800	1284	dfsetup30.tmp	32

C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe
"C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\is-P5GUR.tmp\dfsetup30.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P5GUR.tmp\dfsetup30.tmp" /SL5="$30156,782314,53248,C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\DupFiles\Readme.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DupFiles\Readme.txt

Filesize
2KB

MD5
e14ed25400387e3372c4fe047e3344dd

SHA1
f1bb0155ce3f14c2196591abcb5ed494812f4827

SHA256
57cd4a54d5026eebcaf5f7b3bf148c0e81fc93021202e0a1f4fdf1defa2c8291

SHA512
f8deac7083846443fd61754c4741894470242872de928b8bcd4c240c327fb31126db5e7f354475f6bd8b7792b38e37d26a2ad05184022a1e19e9b7a5bf0ae5ef

Download Submit
\Program Files (x86)\DupFiles\DupFiles.exe

Filesize
1.6MB

MD5
2873287449b17947b6b7a1206db2085e

SHA1
8fc06793de948cebceda5e7a4a468539bd887b1f

SHA256
3697bfa6698c3b9a41744e6afebcb352f6cc948ad8d739ed6558573d8584a0e7

SHA512
84ddf2cc4207ceda54ad0b6beb561f5c22ab8b3d14138bc680b97da43aac87e3ad198f23a9397e5f5bdfb63e55ac6b68cf8cca609384c09981b033ce979af645

Download Submit
\Users\Admin\AppData\Local\Temp\is-P5GUR.tmp\dfsetup30.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
\Users\Admin\AppData\Local\Temp\is-PQQ71.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1284-19-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1284-21-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1284-12-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1284-46-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1284-50-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2064-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2064-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2064-51-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2064-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing