7922d6b15c90eafe42491ce7743593485a80ec16d9ac476b05c13f9059892c7a

General

Target
enderman.exe
Size 269KB
Sample261024-rex1ksvthz
SHA256 7922d6b15c90eafe42491ce7743593485a80ec16d9ac476b05c13f9059892c7a
MD5 d59fc2550b6e1a6dad0063665ba7fa5a
SHA1 bb2f5480b46e759d97cc554010767b810fd8efb6
SHA512 df9a2c12460e0cb24926e32dd146ebb596a62047c20179458a4fbc4fe8b883aedcf8b0fdcb45639a870cde4d445bf76752464f919f41b4affed2224951490af2
SSDEEP 6144:Nw393dtLEzq58BcFN6Q8AnVybOc7V73N65ZjHU:Nw35dS4X8AnVyvLiU
TLSH
T13644D06176D2C032E92354309DBDA770FAB9B8352771954BBF800A2D6E319E2C726793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1356	erroriconscursor.exe
4260	system32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erroriconscursor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	enderman.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	mspaint.exe
2716	mspaint.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2716	mspaint.exe
4260	system32.exe
2716	mspaint.exe
2716	mspaint.exe
2716	mspaint.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1244	4656	enderman.exe	90
PID 1244 wrote to memory of 5088	1244	cmd.exe	92
PID 1244 wrote to memory of 1356	1244	cmd.exe	93
PID 1244 wrote to memory of 4260	1244	cmd.exe	94
PID 1244 wrote to memory of 1260	1244	cmd.exe	95
PID 1244 wrote to memory of 5244	1244	cmd.exe	96
PID 1244 wrote to memory of 2716	1244	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\enderman.exe
"C:\Users\Admin\AppData\Local\Temp\enderman.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\herobrine.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bsod.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
    erroriconscursor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\system32.exe
    system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4260
- - C:\Windows\SysWOW64\explorer.exe
    explorer
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\mspaint.exe
    mspaint.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bsod.hta

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bsod.hta
Size 1KB
SHA256 c7e0d4180cc658c71d44a8cd92c77fac034d91825a2a85b7249e8c3ec0199b99
MD5 b7908011126c28e11d3ff1b0b49c58c9
SHA1 86b6778ee2bb6e20159f337283f1ffa8b0982b05
SHA512 8a2efe13bb54d63edf91edc10e7e8b6b7cdb3c89bb0271c1ff1179ba7eef0784981bdfc4d3d05e0c68a9722d49a6934467e95902b5749689460d7e48e65df22f
TLSH
T1DB318565BF141FC107D7030613A774AD7F32029C319F3900346EC25DA2CAEEAC6A69D2
MD5 SHA1 SHA512 TLSH

Submit Download

erroriconscursor.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
Size 316KB
SHA256 f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d
MD5 135eeb256e92d261066cfd3ffd31fb3e
SHA1 5c275ffd2ab1359249bae8c91bebcab19a185e91
SHA512 a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b
SSDEEP 6144:N11KK324vOlFvSd05W1+5aq2EWykUCuOSTm+q1ZTq3iifGPh:bcVVrSa0MoxEZ+Qy3TGiQU
TLSH
T134641AA4F686FDF5F8459BBD14E1230D539EA291EB2CE7337850FD68010AA5C82B354E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

herobrine.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\herobrine.bat
Size 214B
SHA256 24c553d7fd37ffb22b3267b63f9025f2c2e64141a188c985e601b2d511a09016
MD5 5a8b72980c3aa287461d59de310a450b
SHA1 cd8a202b83afd7b14198c173aa44e77550807e4d
SHA512 b79bf100c2077d7fd004500ad1d0ef8782a4cbe095de955f45c11bfe6bb8d2c39817b45bcea4950903ad4353bcc61b52a9bacb950e5210e1185d855c79f4fa35
TLSH
T11ED08C00CC03448A5DB19C14078D3BAAF45FC16C84DC418D508524A0ECEFCAF3B20A32
MD5 SHA1 SHA512 TLSH

Submit Download

system32.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\system32.exe
Size 32KB
SHA256 ecd62ba67b7f2d9a840a719c292149ea4c81f2158923c961cc801de68bb6b687
MD5 48e7963bdc8b7d6a9385e18457533bb1
SHA1 d22900986dfafd3b31d89d6aa843c78f51e4a73d
SHA512 1ecb6657f17aa32952bc6f7dde2299df01a8d74dd9da84350211516b51ea34db00dec377551aa1274ce5a8d39b1e4a8841ab6aaf8a233920264661d8c3706aa3
SSDEEP 384:8LipZl447piqb/lUYf5uH3w59AMRG5qUIjFgOrjFymqAeO8W8y:dmiiqTfk2AMRGwlFgOrjs4
TLSH
T11CE2E99376A30151FAEF5A3A28798A648733BD685F03CE6EA265333C0830F510D7572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-22-0x0000000000400000-0x0000000000454000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads