af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbd

General

Target

af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe
Size

415KB
MD5

f93a57f8d463af5e4fc8bb2366a985d0
SHA1

cf2e8cc76146f95a9c7b93973a4d40545fe55380
SHA256

af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbd
SHA512

de2a2f64f3fbd95bc7b2f56a2449f78d01a8fff5e2b2aaab82fcf6ce6a557abc5409cc8fc408a825d6c83b03edce9f0bbc80e273469bc046cbac449765e948ea
SSDEEP

6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUo:ITNYrnE3bm/CiejewY5vH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	ximo2ubzn1i.exe

Loads dropped DLL 1 IoCs

pid	Process
2148	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe"	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ximo2ubzn1i.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2360	2148	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe	30
PID 2148 wrote to memory of 2360	2148	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe	30
PID 2148 wrote to memory of 2360	2148	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe	30
PID 2148 wrote to memory of 2360	2148	af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe	30
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31
PID 2360 wrote to memory of 636	2360	ximo2ubzn1i.exe	31

C:\Users\Admin\AppData\Local\Temp\af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe
"C:\Users\Admin\AppData\Local\Temp\af558ccd9263d109c1e8b2cd6dffcc771d7ed61480c102d7bc8a4574f1240fbdN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
  "C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

Filesize
415KB

MD5
4c62c66e274bcb048751c9e0aaf7290d

SHA1
1b5d93574ec8defce1bd34f742327131644b10de

SHA256
08c7aeed39618ae1d3b3c9ab668754fa9152c72b94476a98fc2b0b647b9651bd

SHA512
6a9ef41195611ca8b2bf42e7745915d9591f8cc7d65667b1b5ce0fc44f1a346610bab05e3a43388f3c9454cc363c6bff8ed113618f5d419fe7f4840c539dd0ac

Download Submit
memory/2148-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x0000000000140000-0x00000000001AE000-memory.dmp

Filesize
440KB

Download
memory/2148-2-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-3-0x0000000000950000-0x000000000098C000-memory.dmp

Filesize
240KB

Download
memory/2148-12-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2360-15-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2360-14-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2360-13-0x00000000001C0000-0x000000000022E000-memory.dmp

Filesize
440KB

Download
memory/2360-16-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2360-17-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads