b7ff2dc29209ac243eaea0b7614e26d33136e3d8a1aba97ba211e0e39e209849

General

Target
aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe
Size 10.7MB
Sample261102-g3qlasec82
SHA256 b7ff2dc29209ac243eaea0b7614e26d33136e3d8a1aba97ba211e0e39e209849
MD5 461fab69a26843005cd24abe9078238b
SHA1 9ad4780536ff0a60c05e1507d773fa6318b45ac1
SHA512 90045a7969d70453ac973ec3858105118e974f415c7cbd1a3cd7800b7442b291ea9f5b388a4ab79ab0d118e9fd330c9548a7e028d6d0e84daddec670a16bbb53
SSDEEP 196608:gbUesFcsIJ5xo+wrAZYF1LtUErXQsiWHBCsB4aksPu6JahxA2w5:ZesOJ/4LmETMsBLks26JGeJ
TLSH
T1E9B62331A0A5242BDAF40973F910D230BE2CD7182B1C95AAD5D0ED1D38985FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
5900	wixstdba.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 5900	2920	aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe	88

C:\Users\Admin\AppData\Local\Temp\aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe
"C:\Users\Admin\AppData\Local\Temp\aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe"
1⤵
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1743E419-68CA-429F-B4E3-4A8F86887F2D} {022B07E1-900E-4066-986C-D52F5223BB59}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

thm.wxl

Path C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\1033\thm.wxl
Size 5KB
SHA256 9b241f53878c0da3b3401d9f4c98830c1775b4823536f3e252e14f2b599f31d9
MD5 295c92adfb41f7b8bf3eda428484ce29
SHA1 d8a08e737bfcab3533a945c3426ce4be8eb445af
SHA512 3981167ec9ee4b3ed90ca8cfe9b089f9849dde8dc4535df0ad2815b06b3cb4b33e09a8864edd2209b89ec51a7cc12091ccf80ea5eeb1e18ae2bf5497b965e845
SSDEEP 96:nMcEDTxM1SNuvXhA0SDwZQpCeiYPcyAQ/9zusxeIt:MZ+XSSIZ9zQs
TLSH
T159C1136BA8CFDAE026737A50B6B358C96509C1DA432A1CF0F81A444B87672017373B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\BootstrapperApplicationData.xml
Size 3KB
SHA256 ce95f30920bfa56799990b20054675b476299e4baaa609197fd369bc1d6b86c7
MD5 c24982b9eca01ff8294398cb2f4bcf49
SHA1 80d1dcec9edca0d46175f2d6a4455fefa0e6b718
SHA512 59c5994f6d0b5537d23c9811bf52e772002b88276c7c63dd15e7eee703b21a8700b13d808b995dbda00ff4a5e67c5d2c14e700b69b5d3ea86d1d468e9ce4a0d4
TLSH
T1E28124123BFE1209F1F34F88EAFA6515597AFD916D34C96C01211D0E8973E4189A2FB7
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\thm.xml
Size 10KB
SHA256 e57575c589c8662f724fd2ce4b423e2b5d20951b333c1abe153e208916d17cbc
MD5 7671e5fd976206dc153aa71c75c1d0a7
SHA1 c3baed40ef5373171d9e3488f167609faa44ddc3
SHA512 88640e068cd3628f1bde30ad63a401f7d9103306ffde5f4fae9a399f85e38e927638248b5c6a14d93df2e899eb11e7a0e4fb15d1cbe27e1bf0843906b935b62d
SSDEEP 96:0vPkoeWEHHEpoTcKlCpmVSf5bOBcpR50pQ+OsoJLA1AEpeqFBponx0:0voW6LKyzB5
TLSH
T1A122EB6951DC7811C132D712AB9331D2FF12BDA6C6C49948B48E297B1FF362068BB39C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{05A66D92-325E-49BD-843E-56E7E2B3AEA2}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads