85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f

General

Target

85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe
Size

15KB
MD5

2f044fceb74d77bc75f17fbc24ba0a69
SHA1

3bcad61bf3770c831a502cec4bfa90fdb9e2b693
SHA256

85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f
SHA512

260fd5c7fae6e417f4ba6e09892f04602a8ebefee53a6a876848763581e1359f87bd3f8ed0075e5c74f5e26f7eec43a1c2bea79027b394af9a16ed1172b87d49
SSDEEP

384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYyh60mCT:hDXWipuE+K3/SSHgxmyh6xCT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

DEM9C4F.exeDEMF1FD.exeDEM476C.exeDEM9CEB.exeDEMF27A.exe

pid process

2748 DEM9C4F.exe
2632 DEMF1FD.exe
1688 DEM476C.exe
1032 DEM9CEB.exe
1980 DEMF27A.exe
Loads dropped DLL 5 IoCs

Processes:

85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exeDEM9C4F.exeDEMF1FD.exeDEM476C.exeDEM9CEB.exe

pid process

3060 85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe
2748 DEM9C4F.exe
2632 DEMF1FD.exe
1688 DEM476C.exe
1032 DEM9CEB.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2748	DEM9C4F.exe
2632	DEMF1FD.exe
1688	DEM476C.exe
1032	DEM9CEB.exe
1980	DEMF27A.exe

pid	process
3060	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe
2748	DEM9C4F.exe
2632	DEMF1FD.exe
1688	DEM476C.exe
1032	DEM9CEB.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exeDEM9C4F.exeDEMF1FD.exeDEM476C.exeDEM9CEB.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM9C4F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMF1FD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM476C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM9CEB.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exeDEM9C4F.exeDEMF1FD.exeDEM476C.exeDEM9CEB.exe

description	pid	process	target process
PID 3060 wrote to memory of 2748	3060	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe	DEM9C4F.exe
PID 3060 wrote to memory of 2748	3060	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe	DEM9C4F.exe
PID 3060 wrote to memory of 2748	3060	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe	DEM9C4F.exe
PID 3060 wrote to memory of 2748	3060	85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe	DEM9C4F.exe
PID 2748 wrote to memory of 2632	2748	DEM9C4F.exe	DEMF1FD.exe
PID 2748 wrote to memory of 2632	2748	DEM9C4F.exe	DEMF1FD.exe
PID 2748 wrote to memory of 2632	2748	DEM9C4F.exe	DEMF1FD.exe
PID 2748 wrote to memory of 2632	2748	DEM9C4F.exe	DEMF1FD.exe
PID 2632 wrote to memory of 1688	2632	DEMF1FD.exe	DEM476C.exe
PID 2632 wrote to memory of 1688	2632	DEMF1FD.exe	DEM476C.exe
PID 2632 wrote to memory of 1688	2632	DEMF1FD.exe	DEM476C.exe
PID 2632 wrote to memory of 1688	2632	DEMF1FD.exe	DEM476C.exe
PID 1688 wrote to memory of 1032	1688	DEM476C.exe	DEM9CEB.exe
PID 1688 wrote to memory of 1032	1688	DEM476C.exe	DEM9CEB.exe
PID 1688 wrote to memory of 1032	1688	DEM476C.exe	DEM9CEB.exe
PID 1688 wrote to memory of 1032	1688	DEM476C.exe	DEM9CEB.exe
PID 1032 wrote to memory of 1980	1032	DEM9CEB.exe	DEMF27A.exe
PID 1032 wrote to memory of 1980	1032	DEM9CEB.exe	DEMF27A.exe
PID 1032 wrote to memory of 1980	1032	DEM9CEB.exe	DEMF27A.exe
PID 1032 wrote to memory of 1980	1032	DEM9CEB.exe	DEMF27A.exe

C:\Users\Admin\AppData\Local\Temp\85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe
"C:\Users\Admin\AppData\Local\Temp\85f26a34f7e5465bfea31c842541a04fc29556ec5a577379869f0ec4016be28f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\DEM9C4F.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM9C4F.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\DEMF1FD.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMF1FD.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\DEM476C.exe
      "C:\Users\Admin\AppData\Local\Temp\DEM476C.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\DEM9CEB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM9CEB.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\DEMF27A.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMF27A.exe"
        6⤵
        Executes dropped EXE
        
        PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DEM476C.exe

Filesize
15KB

MD5
66cf3c0395bd7a6557665dcce5abbe8c

SHA1
d51457f762f1d5c79efc1dccf2fc06b544095892

SHA256
6cd493c7660571d69155b7a80228f10b7d3e23ecbcc67970ea72bfc979fd3d13

SHA512
899210896d4a2aac11d85be0fa88d35c664fa6a06a3a3a22638d656a2b351f8625dc415b957213fd603abd495b65e975e775985a55db9f13422b768f41a68572

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEM9C4F.exe

Filesize
15KB

MD5
0848db99bdfa43655531a682050b2435

SHA1
6a836679a66389c4940110f5285a6febee1b42af

SHA256
6bb934f6b6cabc276d4a4749381e2e28c2b950e8f5e10c3bc0ea8b18a8611293

SHA512
ec55a0dad822535a1a0a26c4c3e974560ef69c4f8464b03f5474218cbd13ccf36ced2bd5f0e0d17c2d112c1109bb6cd2a2182366bc36947316620d2358e484a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEM9CEB.exe

Filesize
15KB

MD5
f77efb1fc1565d1ef2f639d46f342304

SHA1
fbd36ac8c16276ca530fcdf83dae2526384b3747

SHA256
3e77bd582552dfe9f962bf4097a95bd0d496a583d1f499eb633d6c7a2a764c89

SHA512
8ef44d7a5bd1e1d1cede0676bc85fe494f4805e6675861abd41a5f5fe683955c51927e8ef565a7c4f2178f3b99533163aecb5ffaa66030dc560cd4ca0cd89c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEMF1FD.exe

Filesize
15KB

MD5
46ce3bb4b5ec862e00d51952140951d7

SHA1
8b186e64178cafd387849f55a2749bebdd5df878

SHA256
20224e7ce21e71f1c6ee35ca6209ec6556270fbb88ef1fe52d6e4713b2925cb9

SHA512
cc085d3df1006da5af6eaddc9f0817e98bac08d32bc65909e1d58e2d9a7695a4164ae56955dc8976258f5d9db03867d474511db834a9deaef58dcec524e75744

Download Submit
\Users\Admin\AppData\Local\Temp\DEMF27A.exe

Filesize
15KB

MD5
f3628023f4430f911673afbd70c539fd

SHA1
f247178b980e7b48ec85d51a787f963f2f405758

SHA256
5abb3e7a2eb61f9ec681e3e7dddcad2ceb83ea84bf5b6d64a300dd2789c4f6b2

SHA512
0acf2ec32f7b90b5db946333064d641c8f0294bf1497108cc16b20eef7feff129d8fc52640100ae4be625a5c8cd55b34aae706ef945b11479b068c46543b75b5

Download Submit

Analysis

Sharing