be9e1d83848eacefff52ceaf6670b4ba7c5e678ced29e91a2766445b6074a42c

General

Target
X-LAME-ACM-Codec_Setup.exe
Size 503KB
Sample261104-vcan2sbx2x
SHA256 be9e1d83848eacefff52ceaf6670b4ba7c5e678ced29e91a2766445b6074a42c
MD5 28584f714d4565aeb27dd149c7da09c3
SHA1 0740f449a888c3f592eae0bcb18abfcd57573ec6
SHA512 2d1cd09fd6f216fd964d8b7c19aba33625e2b873919ac6f05fc9a9b06ed6a993af3ec2882dcdb493cc923b51541d9502c50cf428dc8add859a1c037e638c64c9
SSDEEP 12288:mX4MN/hfY8sEW1/im2SJoaH4fJ9+n8MEXap1Po4aF876Jthz2fnCV+EDs10:44MN/hfY3EWFsPh9O8+p1jaF80ufTK
TLSH
T1A5B41292A1B8C5E7D58003701C37FEB6BA376F222825550B53D83F7F3A31592D91A36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe
6140	X-LAME-ACM-Codec_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
252	tasklist.exe
5896	tasklist.exe
3332	tasklist.exe
2828	tasklist.exe
5520	tasklist.exe
2636	tasklist.exe
3064	tasklist.exe
5436	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lameACM.acm	X-LAME-ACM-Codec_Setup.exe
File created	C:\Windows\SysWOW64\lame_acm.xml	X-LAME-ACM-Codec_Setup.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LAME ACM MP3 Codec\LameACM.inf	X-LAME-ACM-Codec_Setup.exe
File created	C:\Program Files (x86)\LAME ACM MP3 Codec\Uninstall.exe	X-LAME-ACM-Codec_Setup.exe
File created	C:\Program Files (x86)\LAME ACM MP3 Codec\HOWTO Install LAME-ACM on x64.txt	X-LAME-ACM-Codec_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X-LAME-ACM-Codec_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	tasklist.exe
Token: SeDebugPrivilege	2828	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	5436	tasklist.exe
Token: SeDebugPrivilege	252	tasklist.exe
Token: SeDebugPrivilege	5896	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 3332	6140	X-LAME-ACM-Codec_Setup.exe	89
PID 6140 wrote to memory of 2828	6140	X-LAME-ACM-Codec_Setup.exe	92
PID 6140 wrote to memory of 5520	6140	X-LAME-ACM-Codec_Setup.exe	94
PID 6140 wrote to memory of 2636	6140	X-LAME-ACM-Codec_Setup.exe	96
PID 6140 wrote to memory of 3064	6140	X-LAME-ACM-Codec_Setup.exe	98
PID 6140 wrote to memory of 5436	6140	X-LAME-ACM-Codec_Setup.exe	100
PID 6140 wrote to memory of 252	6140	X-LAME-ACM-Codec_Setup.exe	102
PID 6140 wrote to memory of 5896	6140	X-LAME-ACM-Codec_Setup.exe	104

C:\Users\Admin\AppData\Local\Temp\X-LAME-ACM-Codec_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\X-LAME-ACM-Codec_Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq VirtualDub.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq VirtualDub2.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq VirtualDubMod.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq veedub64.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq audacity.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq AviDemux.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5436
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq wmplayer.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq SoundRecorder.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC234.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsuC234.tmp\modern-wizard.bmp
Size 150KB
SHA256 cd45bc5ed5f0c028ddb40925ce8a37ff3a150a144710d10f8f4b9d54059aa8d5
MD5 7cb24cd0fb5eec37f0cb3ad37f65fd4b
SHA1 9063e01b2bc8211809d5741e9642a2264d0032c4
SHA512 da7889a47eff64aca72b799858ddc3e2764cb6f0ad7297e5f72981dce7206c98b40611e31c25ab63dbbd560cd2b4d4ac63c5077356c3411fb71c397f81ec282a
SSDEEP 3072:kNoVCH8aGqZRUNSgHOIK+/crXhNHaa2b1b7qAV1R5XtXvVNDZR/SgE4:qH5GqWDOl+/SUa2bp7qAV1R5XtXjrtE4
TLSH
T11CE38ED37709D91AE9B039D6207530F676FCAB8AEC4683D16057BB35C852DC0CAC7A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC234.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuC234.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads