7760fb6e2ea4f75a5248d6f670aa32bd991a2dd77c7e7d6b95b53a67d3654d02

General

Target
hesaphareketi000,pdf.exe
Size 1.4MB
Sample200811-8krbttbkw6
SHA256 7760fb6e2ea4f75a5248d6f670aa32bd991a2dd77c7e7d6b95b53a67d3654d02
MD5 3212098204ac1cdaf6124a4613a48b39
SHA1 cf2bd91ae275ea715c62f9485485c36180c4a497
SHA512 202886701e3b6e96026a12ec8ffbd18e7b3a7ebbacc6823bd88c2fe18a27f3069f1e0bfd85fe306cab25306176be3f012008cb2af4a4686bb74846698bb57bc0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2972	app.exe
1648	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\app = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\app.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 1648	2972	app.exe	77

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
3932	hesaphareketi000,pdf.exe
2972	app.exe
2972	app.exe
2972	app.exe
1648	RegAsm.exe
1648	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	hesaphareketi000,pdf.exe
Token: SeDebugPrivilege	2972	app.exe
Token: SeDebugPrivilege	1648	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4068	3932	hesaphareketi000,pdf.exe	67
PID 3932 wrote to memory of 4068	3932	hesaphareketi000,pdf.exe	67
PID 3932 wrote to memory of 4068	3932	hesaphareketi000,pdf.exe	67
PID 4068 wrote to memory of 3308	4068	cmd.exe	69
PID 4068 wrote to memory of 3308	4068	cmd.exe	69
PID 4068 wrote to memory of 3308	4068	cmd.exe	69
PID 3932 wrote to memory of 2972	3932	hesaphareketi000,pdf.exe	70
PID 3932 wrote to memory of 2972	3932	hesaphareketi000,pdf.exe	70
PID 3932 wrote to memory of 2972	3932	hesaphareketi000,pdf.exe	70
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 2972 wrote to memory of 1648	2972	app.exe	77
PID 1648 wrote to memory of 2704	1648	RegAsm.exe	79
PID 1648 wrote to memory of 2704	1648	RegAsm.exe	79
PID 1648 wrote to memory of 2704	1648	RegAsm.exe	79
PID 2704 wrote to memory of 3732	2704	cmd.exe	81
PID 2704 wrote to memory of 3732	2704	cmd.exe	81
PID 2704 wrote to memory of 3732	2704	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\hesaphareketi000,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi000,pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v app /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\app.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v app /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\app.exe"
    3⤵
    - Adds Run key to start application
    PID:3308
- C:\Users\Admin\AppData\Roaming\app.exe
  "C:\Users\Admin\AppData\Roaming\app.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe'
        5⤵
        
        PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-28-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/1648-27-0x0000000004BB0000-0x0000000004C21000-memory.dmp

Download

memory/1648-26-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/1648-23-0x0000000000700000-0x00000000007B8000-memory.dmp

Download

memory/1648-22-0x0000000073570000-0x0000000073C5E000-memory.dmp

Download

memory/2972-11-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/2972-17-0x0000000005010000-0x0000000005013000-memory.dmp

Download

memory/3932-0-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/3932-5-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/3932-4-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download

memory/3932-3-0x0000000002AB0000-0x0000000002ABF000-memory.dmp

Download

memory/3932-1-0x0000000000550000-0x0000000000551000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads