0edc105e9bc4e9b297487650e45b6ee0b0ca1e97e2194a2b455d657e428be977

General

Target
DGI-10662.scr
Size 768KB
Sample201005-xr1ab6cg7e
SHA256 0edc105e9bc4e9b297487650e45b6ee0b0ca1e97e2194a2b455d657e428be977
MD5 097f0cb0e08f754b2041911efb3a0f92
SHA1 31ffbaadc9a661f16bf6bb4b8ab27e4e4998c839
SHA512 6e3858360adeee362448646d77f63272872344d38e34e22220889838a620b1bd93c8e744ee15115df100b92f751d905aba64d0561949c512b4489268023fa4a5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	InstallUtil.exe

Executes dropped EXE 2 IoCs

pid	Process
1624	mgdyh.exe
2136	InstallUtil.exe

Loads dropped DLL 2 IoCs

pid	Process
408	DGI-10662.scr
1624	mgdyh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfob = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\mgdyh.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 2136	1624	mgdyh.exe	80

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
408	DGI-10662.scr
1624	mgdyh.exe
2136	InstallUtil.exe
2136	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	DGI-10662.scr
Token: SeDebugPrivilege	1624	mgdyh.exe
Token: SeDebugPrivilege	2136	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3284	408	DGI-10662.scr	76
PID 408 wrote to memory of 3284	408	DGI-10662.scr	76
PID 408 wrote to memory of 3284	408	DGI-10662.scr	76
PID 3284 wrote to memory of 60	3284	cmd.exe	78
PID 3284 wrote to memory of 60	3284	cmd.exe	78
PID 3284 wrote to memory of 60	3284	cmd.exe	78
PID 408 wrote to memory of 1624	408	DGI-10662.scr	79
PID 408 wrote to memory of 1624	408	DGI-10662.scr	79
PID 408 wrote to memory of 1624	408	DGI-10662.scr	79
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80
PID 1624 wrote to memory of 2136	1624	mgdyh.exe	80

C:\Users\Admin\AppData\Local\Temp\DGI-10662.scr
"C:\Users\Admin\AppData\Local\Temp\DGI-10662.scr" /S
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v pfob /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\mgdyh.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v pfob /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\mgdyh.exe"
    3⤵
    - Adds Run key to start application
    PID:60
- C:\Users\Admin\mgdyh.exe
  "C:\Users\Admin\mgdyh.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-1-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/408-3-0x0000000005340000-0x0000000005365000-memory.dmp

Download

memory/408-0-0x0000000073440000-0x0000000073B2E000-memory.dmp

Download

memory/408-6-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/408-4-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/408-5-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/1624-13-0x0000000073440000-0x0000000073B2E000-memory.dmp

Download

memory/1624-22-0x0000000006740000-0x0000000006746000-memory.dmp

Download

memory/2136-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2136-27-0x0000000073440000-0x0000000073B2E000-memory.dmp

Download

memory/2136-31-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/2136-32-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/2136-33-0x00000000060A0000-0x00000000060A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads