b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150

General

Target
b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
Size 491KB
Sample200624-aggbmsegg2
SHA256 b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150
MD5 108b7b7d44f6983ebb4079ae80dedb2e
SHA1 1d1d6748740b590bf0c4f381e1bbf2251ec368c9
SHA512 784e3f52aa9d915a412bd0c65e47d68335d713a4f4071eb48ffad0756e7ee66c42192229d516f0c340316c43705ebf7ff2dd75d5709331e6899216214bd75a81
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1056	images.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 844	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	25
PID 672 wrote to memory of 844	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	25
PID 672 wrote to memory of 844	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	25
PID 672 wrote to memory of 844	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	25
PID 672 wrote to memory of 1056	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	27
PID 672 wrote to memory of 1056	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	27
PID 672 wrote to memory of 1056	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	27
PID 672 wrote to memory of 1056	672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe	27
PID 1056 wrote to memory of 1852	1056	images.exe	29
PID 1056 wrote to memory of 1852	1056	images.exe	29
PID 1056 wrote to memory of 1852	1056	images.exe	29
PID 1056 wrote to memory of 1852	1056	images.exe	29
PID 1056 wrote to memory of 1860	1056	images.exe	30
PID 1056 wrote to memory of 1860	1056	images.exe	30
PID 1056 wrote to memory of 1860	1056	images.exe	30
PID 1056 wrote to memory of 1860	1056	images.exe	30
PID 1056 wrote to memory of 1860	1056	images.exe	30
PID 1056 wrote to memory of 1860	1056	images.exe	30

Loads dropped DLL 1 IoCs

pid	Process
672	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	images.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
844	powershell.exe
844	powershell.exe
1852	powershell.exe
1852	powershell.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe

C:\Users\Admin\AppData\Local\Temp\b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe
"C:\Users\Admin\AppData\Local\Temp\b0a07341a4c0e316a7b8ebc2b0fafa04439bd033002d653d3be2a024dfd93150.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Adds Run entry to start application
- NTFS ADS
PID:672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-0-0x0000000002010000-0x0000000002163000-memory.dmp

Download

memory/1056-8-0x00000000008C0000-0x0000000000A13000-memory.dmp

Download

memory/1860-15-0x0000000000140000-0x0000000000141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads