9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5

General

Target
9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Size 257KB
Sample201108-nlmkmlcpbx
SHA256 9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5
MD5 133fd41dc5a86a5b28b05a9fc0ce96d9
SHA1 c5a87935eb4d40f7d24190b41fdef68511ddcd82
SHA512 3378e654f3ae7f5976126a9be007add69e9e16804d5b3e6ad78eafce7a4ed30a75a2af2cfcde722c5b4108d3727c46c305300c1ea3fb6d54d143d91b0e77b81c
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\duclekyi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Okpoxsvcmys\\qexqim.exe\""	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1340	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1340	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1120	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1340	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	29
PID 788 wrote to memory of 1340	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	29
PID 788 wrote to memory of 1340	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	29
PID 788 wrote to memory of 1340	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	29
PID 788 wrote to memory of 1536	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	30
PID 788 wrote to memory of 1536	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	30
PID 788 wrote to memory of 1536	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	30
PID 788 wrote to memory of 1536	788	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	30
PID 472 wrote to memory of 1120	472	taskeng.exe	33
PID 472 wrote to memory of 1120	472	taskeng.exe	33
PID 472 wrote to memory of 1120	472	taskeng.exe	33
PID 472 wrote to memory of 1120	472	taskeng.exe	33

C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
"C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
  C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yfqcacyj /tr "\"C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe\" /I yfqcacyj" /SC ONCE /Z /ST 19:33 /ET 19:45
  2⤵
  - Creates scheduled task(s)
  PID:1536

C:\Windows\system32\taskeng.exe
taskeng.exe {275AC778-68F8-43BD-9715-34A8BC199641} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
  C:\Users\Admin\AppData\Local\Temp\9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe /I yfqcacyj
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120