06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45

General

Target
[email protected]
Size 1.2MB
Sample260930-fxd5msvyax
SHA256 06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45
MD5 910dd666c83efd3496f21f9f211cdc1f
SHA1 77cd736ee1697beda0ac65da24455ec566ba7440
SHA512 467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47
SSDEEP 24576:Lutr5OUF7zfbMEsJiZp8uSOBpik+Qijrcq0y0JL4SprofsCghjmxQ:LuXfbMvGei9yjrcq0y0JL4ggghjv
TLSH
T1F845239370D25075E067823A7E2C279E97F9E83D41E8F94AB7781B0E7E213158627B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
624	avpc2009.exe

Loads dropped DLL 3 IoCs

pid	Process
624	avpc2009.exe
624	avpc2009.exe
624	avpc2009.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_240680062	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avpc2009.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avpc2009.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avpc2009.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
624	avpc2009.exe
624	avpc2009.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
624	avpc2009.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
624	avpc2009.exe
624	avpc2009.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 624	4588	[email protected]	87

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
  "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avpc2009.exe

Path C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
Size 9.0MB
SHA256 9c42eca99e96a7402716fd865b57ea601fb9a18477fe2ab890bdbcd3052f68f8
MD5 c18a7323332b3292a8e0f1c81df65698
SHA1 bcb8f34cbe0137e888d06acbcb6508417851a087
SHA512 4d48d11f3d0a740b9193e17782c77b01f52dd6e8324755aa81188295a0caed0718d330453bb02ca8bc942ee5588928e57a0d89d90d6b1c32690338c5eae8e1ad
SSDEEP 98304:akMZNqXXZh/M7Y13c9FAddv2z6/HsRsUrnlBvaFOUREPaRZMF6knx82R617:k17Y13c9AvWaFOUREPaRZMF6knx8Q617
TLSH
T11296B84026F1B912D7219FB9CEFA5A789168FDE105BCA24E5087BED1463F723482DF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzip2.dll

Path C:\Program Files (x86)\antiviruspc2009\bzip2.dll
Size 67KB
SHA256 da25db24809479051d980be5e186926dd53233a76dfe357a455387646befca76
MD5 4143d4973e0f5a5180e114bdd868d4d2
SHA1 b47fd2cf9db0f37c04e4425085fb953cbce81478
SHA512 e21827712a4870461921e7996506ffe456dd2303b69de370aa0499dde2e4747a73d8c0e8bd7d91c5bbc414ed5ee06f36d172237489494b3dd311ccd95ba07ebc
SSDEEP 1536:S9FWW0igMY08p/41AdhEfWoh8eGf9NvvvvvvvvvvvvvvvvJQfBq:S9FxMJj3EWne290
TLSH
T1D8637D04F2C18DB6DA818EB044FAF5359939BF244134D2BBD7EB4C6F76217905CA632A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libltdl3.dll

Path C:\Program Files (x86)\antiviruspc2009\libltdl3.dll
Size 34KB
SHA256 f9c9d2b92efb80f6d11df52735b8bddd099847cc79ba56650793b21a0923b1cd
MD5 00a71b4afda8033235432b1c433fecc7
SHA1 d7b0c218aa8fec1c60ada26a09d9e0d9601985ca
SHA512 96635e66d9781ad4d2414271f6a0904cf880ed94fc19186ef4da5f88f24e14ef1591fdc90e27db15a6021847c592688d0034f20e2e50ca93bf8c6db27e8c510a
SSDEEP 768:IZw9E10THMXYyumdlZ3+aJdKE/z85TISX+RfnW:IC9E1yHMXNfdX3+TWz8WRu
TLSH
T14FF22A87D353C270EE79017441698B7FA876EC10A844A4EBFF72F9DD6871172A392392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pthreadVC2.dll

Path C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll
Size 84KB
SHA256 8aecab563b3c629e8f9dcd525dc2d6b1903f6c600637e63b1efe05e3c64d757b
MD5 0ab7d0e87f3843f8104b3670f5a9af62
SHA1 10c09a12e318f0fbebf70c4c42ad6ee31d9df2e5
SHA512 e08e17167edf461c0fca1e8b649c0c395793e80f5400f5cbb7d7906d0c99e955fcf6be2300db8663d413c4b3ffb075112a6ce5bf259553c0fd3d76200ee0d375
SSDEEP 768:bspjN7masPcbmZOzyKGdsmkHtpwpSH3UMp4K0/06gZiH3YbcZ8ysAa23Zm:eOEEMzHtpc2l0/0JZiH3YbcZ8lh
TLSH
T17483F8D6A63984FEE0F304BD167A2B771D23B859170529CFE1B0E2650F792D1EE38246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-27-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

memory/624-28-0x0000000068440000-0x0000000068457000-memory.dmp

Download

memory/624-33-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads