5942b57d50e389ec7be01bd5b4007249e3755064fe156941dfbe310f7fa53a73

General

Target

data.bin.exe
Size

197KB
MD5

5bde9bdb9109fc4004387aad4a99efef
SHA1

003231449d62dfbe594937f1546e5b0a92fe3c46
SHA256

5942b57d50e389ec7be01bd5b4007249e3755064fe156941dfbe310f7fa53a73
SHA512

dffa54aa89e62bcb69bd2b35f2402c333902e2497dac428c1964b5020716c6d8ade003013abeb6705904e95838c601106449f9e9dc62974355fb73320f0535f2

Score

10^/10

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3640	3908	data.bin.exe	73
PID 3908 wrote to memory of 3640	3908	data.bin.exe	73
PID 3908 wrote to memory of 3640	3908	data.bin.exe	73
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3640 wrote to memory of 3752	3640	gennt.exe	74
PID 3752 wrote to memory of 572	3752	secinit.exe	75
PID 3752 wrote to memory of 572	3752	secinit.exe	75
PID 3752 wrote to memory of 572	3752	secinit.exe	75
PID 3752 wrote to memory of 1040	3752	secinit.exe	77
PID 3752 wrote to memory of 1040	3752	secinit.exe	77
PID 3752 wrote to memory of 1040	3752	secinit.exe	77

Executes dropped EXE 2 IoCs

pid	Process
3640	gennt.exe
1040	edabaluvileqec.exe

Deletes itself 1 IoCs

pid	Process
3640	gennt.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	secinit.exe
3752	secinit.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	data.bin.exe
File opened for modification	C:\Windows\	gennt.exe
File opened for modification	C:\Windows\	secinit.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\d082df836616ecbce5f8\\gennt.exe\""	secinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\d082df836616ecbce5f8\\gennt.exe\""	gennt.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082