f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470

General

Target
f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
Size 1.1MB
Sample260703-rt9b6af19r
SHA256 f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470
MD5 3fa1689d609454e6036ca3906cd97379
SHA1 b5b85512cc228a4c813a58d2d8c10cb91ce8fd4b
SHA512 8c6d182c7298c166018c52aa6878247183e51979ea0b7ca978c4756a0faca9e61db6bfeb229401478d4b49c7b056fd902842cc7c1162f2025cf5eff66221d686
SSDEEP 24576:n5EmXFtKaL4/oFe5T9yyXYfP1ijXdadIeCLOLDkUouTS:nPVt/LZeJbInQRadIsd
TLSH
T1E345BF027381C062FFAB96334F56F6115BBC79260123A62F13981DBABD705B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apostrophise.vbs	apostrophise.exe

Executes dropped EXE 4 IoCs

pid	Process
6160	apostrophise.exe
3796	apostrophise.exe
6548	apostrophise.exe
6212	apostrophise.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c00000001c6ad-13.dat	autoit_exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	6212	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apostrophise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apostrophise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apostrophise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apostrophise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
6160	apostrophise.exe
3796	apostrophise.exe
6548	apostrophise.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5824	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
5824	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
6160	apostrophise.exe
6160	apostrophise.exe
3796	apostrophise.exe
3796	apostrophise.exe
6548	apostrophise.exe
6548	apostrophise.exe
6212	apostrophise.exe
6212	apostrophise.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
5824	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
5824	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
6160	apostrophise.exe
6160	apostrophise.exe
3796	apostrophise.exe
3796	apostrophise.exe
6548	apostrophise.exe
6548	apostrophise.exe
6212	apostrophise.exe
6212	apostrophise.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 6160	5824	f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe	89
PID 6160 wrote to memory of 3876	6160	apostrophise.exe	90
PID 6160 wrote to memory of 3796	6160	apostrophise.exe	91
PID 3796 wrote to memory of 2588	3796	apostrophise.exe	92
PID 3796 wrote to memory of 6548	3796	apostrophise.exe	93
PID 6548 wrote to memory of 2312	6548	apostrophise.exe	94
PID 6548 wrote to memory of 6212	6548	apostrophise.exe	95
PID 6212 wrote to memory of 7012	6212	apostrophise.exe	96

C:\Users\Admin\AppData\Local\Temp\f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe
"C:\Users\Admin\AppData\Local\Temp\f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe
  "C:\Users\Admin\AppData\Local\Temp\f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470.exe"
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe
    "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe
      "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:6548
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe
        
        "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:6212
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe"
        6⤵
        
        PID:7012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 712
        6⤵
        Program crash
        
        PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 6212 -ip 6212
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autB82F.tmp

Path C:\Users\Admin\AppData\Local\Temp\autB82F.tmp
Size 238KB
SHA256 1702bb0287588dabf88327dc28112f817753d7df1f831677b5628ac6e3dbdd13
MD5 3f06abb856828cc9fff98fee3ef7fa8a
SHA1 8a760063486554fd75e4f47a4b345ff8d90312e2
SHA512 d7ebfdd3d66fbc39331a5d389d0435c4416d0ee0b89e1c7d433bfb35594942a905e08ace9e200de79862180aa3b012a44f74793bda3de0b16c5ca8181fe55620
SSDEEP 6144:o9TbuaSE7WsJ1PpdlSE8zjTGL+M5zu+f+/4XaLeaN7Rpv:o9nd7XJ1Bd/IyCmzzf+/EWpvv
TLSH
T1623423E9648C884C8441C4023DDEF1C74F878BD6E4EEF65AA74CDE224EDBD2C266685D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autB840.tmp

Path C:\Users\Admin\AppData\Local\Temp\autB840.tmp
Size 9KB
SHA256 5c8744c6218cd61fae97c2b1eb832aeee869dfd233b231343e249287dbc7d39c
MD5 3a12cfadb45ee5c015670440695cab51
SHA1 87c2e138c26c0f364e37c6919849940cb91c1c94
SHA512 b1a5fe5c17319cbc8d60982d4ee4229d51f2cf72bb47588bcd15cc8287260a59391e511c8a1c64c7ec3c5efdedbe020d0e53a883624f4409a0130cee375b975e
SSDEEP 192:VfyKYff6BqlUebVc4sWLNJw/iMHMW6QvRIBnnVKJFsSMuE:lyPXfUf4sCJw/tKQaV0Fs8E
TLSH
T13712AE3628C697E66A8580D53DB81D334DC2D488DE0CECA02AED6336C558029B832726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buncal

Path C:\Users\Admin\AppData\Local\Temp\buncal
Size 243KB
SHA256 f0cb4fb4b047e29b93e2ee6c7ac6b9c278d2d69595b1443f535847a92b4c2f45
MD5 92246e34db4e76128254bbde1fd09a24
SHA1 7422ad855f235a1374205e82a540af048416a96a
SHA512 43562bf1ff41ac3240be6df6547766c1bae4103af721928a618ca69d3af1b0f00c34c3e9e705b7adc4838b6222ebe5fda7fd9636f70623a42f99c4023fa804ca
SSDEEP 6144:QVdpoccmGAVl18U7C0XMee3psPID8Zc2JahOO7E:QVdpoeGolOc8t3psPIoWUahOD
TLSH
T18B34DF70B227633AB25CA0624DB2D1CA49E2C57F341FC1FA65215C56BFC58B1EB48B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

immortaliser

Path C:\Users\Admin\AppData\Local\Temp\immortaliser
Size 29KB
SHA256 d500c038f70b8daa52714ec055aae60dc6648b96de873a7cf377bf96b5add4d6
MD5 836644f5b7fde20fb4dbfc01191642f7
SHA1 25d6a0a21a7462132224f5a76dffdd1265ba1a9b
SHA512 4d67082424000da7941a1c1e06b5cdb385ef23537a4821392fc79616eb587dedcbdbed2e84911f4a05884cfd482db8ed04c10024884edf58ddb2576d361250d2
SSDEEP 192:aIU0YzxURqp0mDY+j5FeDE49yry+a9ydKyBqla4AxOz1nCjYLD1LXVBvbcENwwZu:rYzxrp0zUaIBsDLXDXFQQdgRYT3509
TLSH
T150D2BAA02C6F09E035ADD570F30CDB7CAE61D2957C9D6127CD872C738272A11A46ABED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apostrophise.exe

Path C:\Users\Admin\AppData\Local\intemerateness\apostrophise.exe
Size 1.1MB
SHA256 f57a8a3730a6ed05279d48cf6adeb39418ba8c1fbfb6fda028b4b3976af16470
MD5 3fa1689d609454e6036ca3906cd97379
SHA1 b5b85512cc228a4c813a58d2d8c10cb91ce8fd4b
SHA512 8c6d182c7298c166018c52aa6878247183e51979ea0b7ca978c4756a0faca9e61db6bfeb229401478d4b49c7b056fd902842cc7c1162f2025cf5eff66221d686
SSDEEP 24576:n5EmXFtKaL4/oFe5T9yyXYfP1ijXdadIeCLOLDkUouTS:nPVt/LZeJbInQRadIsd
TLSH
T1E345BF027381C062FFAB96334F56F6115BBC79260123A62F13981DBABD705B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5824-9-0x0000000000E90000-0x0000000000E94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads