4afa33bc8e7d8de4d756a130e11fb750236c117b0b75a404c808a3567de4c64e

General

Target
jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
Size 585KB
Sample261018-syetsaev6r
SHA256 4afa33bc8e7d8de4d756a130e11fb750236c117b0b75a404c808a3567de4c64e
MD5 709fd67f58721e614c3404ce71650c75
SHA1 934d7098c9d4328cd2eb9b5a3d418692a96e9e7a
SHA512 39f64fcf61f02d5f27b4d667e4c486c52742e6c7b6c86c01df5c00f800646f89a2378ae3b892baead470499fb8ea071c6567906ece7de59f979d528fed7b3497
SSDEEP 12288:6vYEXCS71DW91IZU5hUkVpmM7ehBMsPvZZ7ABc8hR:0+SBDnZUECpm3KsPL8ckR
TLSH
T1BED48E22B6D18833D17359789D1B929D943BBE212D78649B7BE41E4CAF3C781342E2D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4188	fxinst.exe
3832	fxinst.exe
5416	Microsys.dll

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\fxinst.exe = "\"C:\\Program Files\\autofx\\fxinst.exe\""	fxinst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\fxinst.exe = "\"C:\\Program Files\\autofx\\fxinst.exe\""	fxinst.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\autofx\Microsys.dll	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
File opened for modification	C:\Program Files\autofx\Microsys.dll	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
File created	C:\Program Files\autofx\fxplay.exe	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
File created	C:\Program Files\autofx\fxinst.exe	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsys.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxinst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
5536	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 4188	5536	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe	90
PID 5536 wrote to memory of 5416	5536	jaffacakes118_Trojan.Win32.Stoldt.fmx.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Stoldt.fmx.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Stoldt.fmx.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\autofx\fxinst.exe
  "C:\Program Files\autofx\fxinst.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\Program Files\autofx\Microsys.dll
  "C:\Program Files\autofx\Microsys.dll"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5416

C:\Program Files\autofx\fxinst.exe
"C:\Program Files\autofx\fxinst.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsys.dll

Path C:\Program Files\autofx\Microsys.dll
Size 27KB
SHA256 80aac9bfd563788e1907c554a77b89f7bd17bc3efd97dd68e979f718b2679b2f
MD5 c8960a44334e5890771bb70ea2c6ecbe
SHA1 fdbffbd5e0387be19ac5cf4ef346adb6bbefe9e6
SHA512 c5e41068806ec118f519021e7a0a402e73b682d6b0f949a76babbe976b62bd6372812e4af823280f99005a474d85f57e8fc11dab375b0d84d9454af57ad6f52b
SSDEEP 768:sq7ZJl5/ija+1IGhpV3qTABXRjkTsGkyh7Ln9jnp:saZJOptqTwkTdL
TLSH
T142C24B4BB9C1C0B1D028C8752D76C39FA63F3F714C91E0E6FAA55E9C9CA4B85215C6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxinst.exe

Path C:\Program Files\autofx\fxinst.exe
Size 81KB
SHA256 405b2a514a10bfaab952c2aaaa9d852aae99683d88048d9ec0c211cf5f37ec90
MD5 a23dcaf89be940cba641b1c7950db760
SHA1 8cf755fb813dc8f92fe79a40b195fe01047ddb2a
SHA512 b3b15f1732883f5aafc9dd86cc57c9648cb947538a721a3395952c3a632e0475976797c200bc5ba0aac78229f35025b64291c7c8a74da4721dbff34ba4ced6bc
SSDEEP 1536:fUgSUMn/0/PSS9wY/CxhhEYUa76oELx5AnoeL+By:fUgSUQetyhhEYUa767xmoa+By
TLSH
T1F0835B5BB18188B1D0359DB8EC19F29A546FFD721C29A09F75E50F4E8CBCB91981CBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3832-10-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4188-9-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/5416-24-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5536-8-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5536-34-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads