12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236

General

Target
12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe
Size 206KB
Sample200624-69s6wssp82
SHA256 12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236
MD5 665ecdf0d3226406088a0c6665b106f7
SHA1 2a93260b210cc5e08aebcb653247c8d2e82ddcad
SHA512 759b64230d329797d5066baafb32c0a50d657b9ced7c6fad99ad0f4ec8d529aa188213c4077307cd5cd4eaaa0c43c8d52636e3342876c85905fa8f7d9afdf91b
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1156 set thread context of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1444	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1444	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	24
PID 1156 wrote to memory of 1444	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	24
PID 1156 wrote to memory of 1444	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	24
PID 1156 wrote to memory of 1444	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	24
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26
PID 1156 wrote to memory of 272	1156	12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe	26

C:\Users\Admin\AppData\Local\Temp\12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe
"C:\Users\Admin\AppData\Local\Temp\12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KeLimkqwPgwOiA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA6D9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "{path}"
  2⤵
  PID:272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-4-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/272-6-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads