631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166

General

Target
631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
Size 403KB
Sample260810-y2w55axeja
SHA256 631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166
MD5 84488ff3ff0f2a00d363b0d235a1a234
SHA1 8d9e9ede7d8d0354955e7c18328fe30a73c8537b
SHA512 ae70c7b84ff4fe9f36d4730e9d4878df64cc992cd035ef861a0b7df2a6d47c47bc5d328217e56389a7d425cde790d4547c81f4f3c02ff8a55671ca91eb42efd0
SSDEEP 6144:0LsBN8xoIy7fXjhQVJPZR2yJexyEcBcUT8fQR5PKQt:PBb7fXjhwPm0exy9BcU4foKQ
TLSH
T1B794487EB6D7F422EB58C979BD59DA5E0950DDC003BC0B1ED3F03AA975B6A42B10B108
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
8	drive.google.com
18	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
4616	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Omnivoracity\analities.txt	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
File opened for modification	C:\Program Files (x86)\Common Files\ekskommunicere\ideals.ini	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\manipulerende\Stenkugler.zip	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
File opened for modification	C:\Windows\resources\0409\Extrinsicality.ini	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
Token: SeBackupPrivilege	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 5036	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	89
PID 804 wrote to memory of 3376	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	90
PID 804 wrote to memory of 4956	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	92
PID 804 wrote to memory of 4616	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	93
PID 804 wrote to memory of 4616	804	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	93
PID 4616 wrote to memory of 1456	4616	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe	94

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe

C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
"C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:804
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "804" "1088" "960" "1128" "0" "0" "1116" "1112" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "804" "1156" "844" "1104" "0" "0" "1168" "1164" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
  "C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
  "C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe
    "C:\Users\Admin\AppData\Local\Temp\631e3275d1830100cc76d3dda6b82aa9bdaa3a620ff682d00e6191e3830b3166.exe"
    3⤵
    PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5A1D.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afsnitsnummerering.lnk

Path C:\Users\Admin\afsnitsnummerering.lnk
Size 1KB
SHA256 e4e7097fe5364cf8cb5d188bbcb5187c31dc3383a921b0215c60233cecf37062
MD5 e23a13d4c2fb22075bff1d9eeb98a34e
SHA1 de60abd32d07edb4641780b6063d8a9b74791c6a
SHA512 d63f3005966490493c103bb05ebacb1d194d818154afbddc2b615d927041c5604d088bfe166c37c831cff5c142e0fc7c54a13e033362b74017a254bf86f9cda7
TLSH
T19F2136019EE51235E2F68BB1A5FB6714DB627867AB849E0D0000904D3871B10EDB4F2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-46-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/4616-47-0x0000000000830000-0x0000000001B16000-memory.dmp