d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2

General

Target
d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
Size 60KB
Sample260423-jb41qaes2t
SHA256 d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2
MD5 274df1bf1919656660dbd2f9631647f0
SHA1 0ce224fe2772ee771afc6bed10a2bbfd549bece6
SHA512 5a66a531a986acf6cf5a8129927bd4759062631af0e84b8be77004e62e2b15dbd231753fec71ff1155af02db13956431a3913734542371caff0befe63532ee13
SSDEEP 768:a+Rj+ind7d7rXaKR95ss4scBIzPkzgBYzddB+ksMZEsJ8JtjmPwe/ErjOT8fo6un:vRiAXaKD5gxzmwYEM/D3oNd/
TLSH
T17653CF1BBD6947A1D618D4B149331A71EAE3B92B55344273BBC7FE2DEC34A408B12388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5372	jjqqo.exe

Executes dropped EXE 1 IoCs

pid	Process
5372	jjqqo.exe

Loads dropped DLL 1 IoCs

pid	Process
4832	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4816	4832	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jjqqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4736	cmd.exe
4944	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4944	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4756	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
5372	jjqqo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4736	4756	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe	84
PID 4736 wrote to memory of 4944	4736	cmd.exe	86
PID 4736 wrote to memory of 5372	4736	cmd.exe	87
PID 5372 wrote to memory of 4832	5372	jjqqo.exe	88

C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
"C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&c:\jjqqo.exe "C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4944
- - \??\c:\jjqqo.exe
    c:\jjqqo.exe "C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\ckzrh\mjxtq.dll",GetWindowClass c:\jjqqo.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 564
        5⤵
        Program crash
        
        PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4832 -ip 4832
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jjqqo.exe

Path C:\jjqqo.exe
Size 61KB
SHA256 06c45cc6a39f3cc994721394e6216a89f022d1c34bc17d7cfe7b60de5804b804
MD5 96de00c5261a3923ca8700e44ccb2ed0
SHA1 0825ffbcc835b8314ebb460677641b30d9c66fd8
SHA512 d98c19385ca4f6ebd743586b6f7ab0f1e03be8311560e89c7ecb50f4511417ff7a0f6bd0dfe57a6141b3bfee7a4440d0b8a45e9031e0291533a28aed9b373513
SSDEEP 768:a+Rj+ind7d7rXaKR95ss4scBIzPkzgBYzddB+ksMZEsJ8JtjmPwe/ErjOT8fo6uP:vRiAXaKD5gxzmwYEM/D3oNdH
TLSH
T13D53C01BB97947A1D518D4B146331A71EAE3BD2B55384173BBCBFE2DEC34A408B12388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjxtq.dll

Path \??\c:\ckzrh\mjxtq.dll
Size 46KB
SHA256 3b593bf9d31e743eaba663ef6afed8fb8201fd7f5fc0f9024a29b9f4198a0dbb
MD5 5828c811810a16f4d7ce7e09bba18ee3
SHA1 e5d5009a60dda29057b1a2080fb71afa07aca4e2
SHA512 3e0481d6d0dec41296bc30d9be080f82aa7d9f047d452321fabe073e89b02d1644d1dcf434981d9d5b22752213c058f281814f3e3c6c620d8a727c616c51050e
SSDEEP 768:2sUfnvxs6iLlhpfFPtnQf7kifD/v7yb9Bh7Cb0PMP:2sJT1qf4W/vub9nn8
TLSH
T15D23E1947AF0CEE3DEF80A3785F5799849ADA9785B638E103C1650CE283011FEA5067A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4756-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4756-2-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4832-11-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/5372-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/5372-8-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads