4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d

General

Target
4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
Size 554KB
Sample260727-ff96rahj31
SHA256 4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d
MD5 ac45cca1364f6a367769a0c8332e54b1
SHA1 ef1a0f8328c9d425cb60f4c119e25d8b3c32332d
SHA512 7078e903c09f95fe5c61c49c992360d1f8b890020f5244587f5896235bb369efe1250753d960d82abfcf058abf37572b32ec9429f564cb13a721b8c3ebdf9b04
SSDEEP 12288:GYo2wbdWNVzsKSymlMvJqUyOYXTpoc3bVv8l7dHiYVVVRfdzN:RnwbQVIb1lMvhyOYDpoc3bV8BCYRPzN
TLSH
T11EC422AEB1D6F892EA867271BA7643731F74D94F4052CA9307B0168AFC712835D1A707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Mirrorize.htm	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\reserveringsnummers\tjringens.ini	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
File opened for modification	C:\Windows\resources\0409\storage.ini	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5304	4424	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 7048 wrote to memory of 2440	7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe	91
PID 7048 wrote to memory of 4424	7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe	92
PID 7048 wrote to memory of 4424	7048	4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe	92

C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
"C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:7048
- C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
  "C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe"
  2⤵
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe
  "C:\Users\Admin\AppData\Local\Temp\4f89186921e9841c761efd9608beafa691675d47ab5e0d08a816a64b9b62122d.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 456
    3⤵
    - Program crash
    PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4424 -ip 4424
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA86.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trawlings249.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Trawlings249.ini
Size 44B
SHA256 8370a63c81b070fe53432b89cd900971333fc68f8bd68d535d2df18ed07d5496
MD5 15e0e4b4af08d8a3cd9fe4fc16a24d5c
SHA1 1b08f14e8e456d18bd2bc9e6317a18b39173183f
SHA512 2083f9b2c8f282496b82b03be4135fe8706830b278268e565f7841bebc223818955a983ed2ecdf502da4deff7a04e99eb5e586c75b45269ab3f208f55a28a219
MD5 SHA1 SHA512

Submit Download

stbninger.ini

Path C:\Users\Admin\Documents\stbninger.ini
Size 50B
SHA256 889edaa83b1b0885c27d94d266da2d29d0212bd8cd488028deaaf231127b4acd
MD5 b952551ca3dc7a7147096c30e1500aae
SHA1 e0d654cb64dd227c71572742059db237f3d33f6e
SHA512 9270c8103615f39c2d190a51b4cddbbc13e4bf0b27931bcd939b3c96590ff36ca2d6598dc270f460280088a169f3c1f77d65f2a945ffc9df0edf8b015cd96385
TLSH
T1BD9002188C164475D710061C4A546885965B1537554895EC098611AD4867014841FA12
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4424-881-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/7048-880-0x0000000074875000-0x0000000074876000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads