347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb

General

Target
347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
Size 390KB
Sample260703-3pg8nadv3p
SHA256 347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb
MD5 9caef9f6cf774a6695b360cc17994263
SHA1 926cf4d64a30e845de69894a552a3518bc5cf235
SHA512 48f04f3f2929372e4098ae3e46ff4ffd458be4ab6b8a06dde455939fe2df783810167a65ce8fd749d2df0e0d622d070081754e6176b19a47a94d4a8199acc0b9
SSDEEP 6144:LB+pgUDTo+3SNM59oaGcXiVpVLo6PDkh9jwRY6cWV5osSeliFPgun9hbW:LgbtlHoYW19O9jwRkeCsyFnzW
TLSH
T12E84F12136B4DA53F93205F04853C53620F76E3879164D539ED43BAE9EB2793FA2CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\muget.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
2516	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Smokingjakkens\endevrdierne.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\prosodist.lnk	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\Fonts\prosodist.lnk	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\Fonts\Navtas\Grnsefunktioner.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\dobbeltsidet.exe	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\Delandene\indsnusning.gif	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\bemole\opnormeringen.bin	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\Pomerans.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3148	3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	88
PID 3168 wrote to memory of 2516	3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	89
PID 3168 wrote to memory of 2516	3168	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	89
PID 2516 wrote to memory of 5504	2516	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	90

C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
"C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
  "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
  2⤵
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
  "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
    "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
    3⤵
    PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaC560.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

butiks.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\butiks.lnk
Size 984B
SHA256 465dd509f2f6e90bdc46c8225a17d4ea2c786e7a4373cc01f5211f94acc357c4
MD5 b99d65538fb9b9ea48b1fddbd345e4f3
SHA1 44671127af3eb61aa22ce3b094408c45f23dd1e5
SHA512 218eed8864ab91056c1638460cc0a4ea23cb0f92723e65ba119befb13a544c4c4dd9709d3739fa45c12c4bd97aa21423890ccb5ec0d04fb8b0c618ef8455103f
TLSH
T1A31147148AA82B10E3F64F75A9EA2712D43A7C63EE909B48001441C458707A1D6F4F3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2516-1155-0x00000000004A0000-0x0000000001786000-memory.dmp

Download

Analysis

Sharing