6b4a52f825acb200d074d0d4d464952f505ef215b9d1741424c3bb9dfea748ea

General

Target
3ntr_Perm/#2cleaner.exe
Size 5.8MB
Sample260913-sd7ztsycjf
SHA256 6b4a52f825acb200d074d0d4d464952f505ef215b9d1741424c3bb9dfea748ea
MD5 c0a59b27d3d53bf48fdfde5427ac0055
SHA1 030ddf0d4538cc7c46def291de2d500febddcce3
SHA512 6d3a4d4227a102df4f25c2fa823608aebda5d7d0e1b6be49a7579fa9d29ac0c256bfbad09a084fceb8ddc90b95a87301c08835fdf3ebf9e0ee4a46f78ac2b486
SSDEEP 98304:0Bqbsoulraw/oMXa7Mhq+0EclbMzRRIh3JIDnkhjXev18ijoQaqGJ:2FjXa7Mkoc6IT8kh3QmJ
TLSH
T12B5633C694032DF0DF9A1479BCB19536D794BD272718C387A553BBC82E6A6E8AF30701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	#2cleaner.exe

Loads dropped DLL 4 IoCs

pid	Process
5032	#2cleaner.exe
5032	#2cleaner.exe
5032	#2cleaner.exe
5032	#2cleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3196	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4636	ipconfig.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	#2cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	#2cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	#2cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	#2cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	#2cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	#2cleaner.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 5032	4488	#2cleaner.exe	88
PID 5032 wrote to memory of 3196	5032	#2cleaner.exe	89
PID 3196 wrote to memory of 4568	3196	cmd.exe	90
PID 5032 wrote to memory of 4412	5032	#2cleaner.exe	91
PID 5032 wrote to memory of 1276	5032	#2cleaner.exe	92
PID 5032 wrote to memory of 4636	5032	#2cleaner.exe	93

C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\#2cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\#2cleaner.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\#2cleaner.exe
  C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\#2cleaner.exe
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode con: cols=100 lines=45 >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\mode.com
      mode con: cols=100 lines=45
      4⤵
      PID:4568
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -delstore Root "CloudFlare Origin Certificate"
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -delstore My "CloudFlare Origin Certificate"
    3⤵
    PID:1276
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5340

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keyauth_clean.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4488_134337880058053474\keyauth_clean.dll
Size 6.3MB
SHA256 0afe01b012b3df68a585620a2406d6c8bf63c113d8843aa3a7a3ec6ce60daf83
MD5 a478386806fdec6ab4366d558b25176d
SHA1 0b4dad3a46a433a2dadff008fcb6e4d8bb0a7cfb
SHA512 53ab8cc3b57ccb205bcd1f82fceb4b7af94b1e14d7b780c9bb46b85c9e7ae0e5e7781ef760220fab2ad1fc48c2ae95dcce5454256a4feb07839e5a415c364607
SSDEEP 49152:fYP/MGLoj/a5kZxbH3QnW/z0L7dh2DShbSURdf7HcuZeAV8u0+8NyoHBgtxpBgs6:fGoy7v2DSprf7HcuZeAV8u0+8NyoHCV
TLSH
T1636628817A92D97BFC55F3B9841B050AB364C4F6B300C75335AEC06AAF8BBA46D614DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4488_134337880058053474\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads