347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb

General

Target
347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
Size 390KB
Sample260727-dssfcshb23
SHA256 347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb
MD5 9caef9f6cf774a6695b360cc17994263
SHA1 926cf4d64a30e845de69894a552a3518bc5cf235
SHA512 48f04f3f2929372e4098ae3e46ff4ffd458be4ab6b8a06dde455939fe2df783810167a65ce8fd749d2df0e0d622d070081754e6176b19a47a94d4a8199acc0b9
SSDEEP 6144:LB+pgUDTo+3SNM59oaGcXiVpVLo6PDkh9jwRY6cWV5osSeliFPgun9hbW:LgbtlHoYW19O9jwRkeCsyFnzW
TLSH
T12E84F12136B4DA53F93205F04853C53620F76E3879164D539ED43BAE9EB2793FA2CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
8	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\muget.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
2864	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Smokingjakkens\endevrdierne.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Navtas\Grnsefunktioner.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\dobbeltsidet.exe	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\Delandene\indsnusning.gif	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\bemole\opnormeringen.bin	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\resources\0409\Pomerans.ini	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File created	C:\Windows\Fonts\prosodist.lnk	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
File opened for modification	C:\Windows\Fonts\prosodist.lnk	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3640	3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	89
PID 3300 wrote to memory of 2864	3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	90
PID 3300 wrote to memory of 2864	3300	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	90
PID 2864 wrote to memory of 5416	2864	347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe	91

C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
"C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
  "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
  2⤵
  PID:3640
- C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
  "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe
    "C:\Users\Admin\AppData\Local\Temp\347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe"
    3⤵
    PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5636.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

butiks.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\butiks.lnk
Size 980B
SHA256 3f92444b796c438dfa17ba732427b8c2b49edfd86abc3e42c242acfc76f118f7
MD5 f334458c7c92782b489984945ea96da0
SHA1 0ed2fdca31df74e3747a95e65224be107d1a010d
SHA512 99ed93efe86e83c10d38961a25da3b4d129337ec58bdda29c8be1d4698444f9325b029c2dfd51a7a92cb42e305e996e3ea05fc33d47ab7734949340fcd9dce45
TLSH
T13F1147088BA53714E3BA8F75A9EA2311C53A7C22EE908B4C001485C46474790E6B4F3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2864-1156-0x00000000004A0000-0x0000000001786000-memory.dmp

Download

Analysis

Sharing