a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd

General

Target

a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
Size

263KB
MD5

0b6b9e4676a713e7c226801b5fc87315
SHA1

167cf657d7b9e56ac4a43d326aa51ed8c5429fd3
SHA256

a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd
SHA512

2df8cec1fb9491aec3518218fc48871702f5a1f2207503f3ad9d9758fdc39729606c5b3d228cc53a813c9bceb8ff92638b6fac3787a0cf68e57f039df6c3c4f4
SSDEEP

6144:SAsBZoikJTvZqKan+Jjj8tjsioCKZ9JqKvryubSquKeqpMM+Ir2:ZDN7a+l8tjsioPZ2Kv2JxZqpxhr2

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	2236	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3760	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3888	2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe	87
PID 2148 wrote to memory of 3888	2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe	87
PID 2148 wrote to memory of 3888	2148	a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe	87

C:\Users\Admin\AppData\Local\Temp\a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
"C:\Users\Admin\AppData\Local\Temp\a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe
  "C:\Users\Admin\AppData\Local\Temp\a73d7acb96ac7fa41ab009baaa19f7c0b9c818d395f24ea66734aa7406fd37fd.exe"
  2⤵
  PID:3888

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODYzMzE2RUUtNjNFMy00OTI4LTgyQUUtMEFEMEMxNURBRjc1fSIgdXNlcmlkPSJ7MDJFMzg0REEtN0FFRS00NzcyLTgxNkMtNkNDRERFMDc1NjE2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDczMkVBNUQtMzJENS00QjMwLTg3NDYtNDRGNEI2ODIwMUMxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjY3NDcwODUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gift.dll

Filesize
63KB

MD5
0f24042f66d3e5d89cc6e21068f765a9

SHA1
8f27a5e556ab83ff5d35a58aa0e0dfd72bb78477

SHA256
00e8df1c5ded11cc861ce46a553cd8c66828bb2ad51241bf6cd0e0d575bb5442

SHA512
30464da8d18bd569fbbfaca7ce5a86eb89accd8f6c6939fc4af4ef3b67d13b57b1db6c77df213ffc19789bbbf86fac1e76c5805c191d34d06776d76217a21e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC296.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
memory/2148-11-0x0000000002F00000-0x0000000002F14000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads