1deade2c1ec1622757e44e7a246cc0b0db62b88cded9cccfc418e1bca6b95b39

General

Target
dc736e5e09d43f1c9a3a23f6cff45401.exe
Size 617KB
Sample210330-d4lf3m1fdx
SHA256 1deade2c1ec1622757e44e7a246cc0b0db62b88cded9cccfc418e1bca6b95b39
MD5 dc736e5e09d43f1c9a3a23f6cff45401
SHA1 edb5f73848b40bbedc5f983818a55b697aa8438a
SHA512 148045798162ff6e980e2483d51ba1e6f579ce1ffe55d15f427eb559d014cbc2bead0d7d65fe970faea46f976b59b2bd95ccb7f448aa78d215ad8a3e37aa5c4d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4052	Netplwiz.exe

Loads dropped DLL 1 IoCs

pid	Process
4052	Netplwiz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jksfmi = "C:\\Users\\Public\\Libraries\\imfskJ.url"	dc736e5e09d43f1c9a3a23f6cff45401.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78
PID 1316 wrote to memory of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78
PID 1316 wrote to memory of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78
PID 1316 wrote to memory of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78
PID 1316 wrote to memory of 1048	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	78
PID 1316 wrote to memory of 1044	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	79
PID 1316 wrote to memory of 1044	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	79
PID 1316 wrote to memory of 1044	1316	dc736e5e09d43f1c9a3a23f6cff45401.exe	79
PID 1044 wrote to memory of 4052	1044	cmd.exe	81
PID 1044 wrote to memory of 4052	1044	cmd.exe	81
PID 4052 wrote to memory of 3944	4052	Netplwiz.exe	82
PID 4052 wrote to memory of 3944	4052	Netplwiz.exe	82
PID 3944 wrote to memory of 2160	3944	cmd.exe	84
PID 3944 wrote to memory of 2160	3944	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\dc736e5e09d43f1c9a3a23f6cff45401.exe
"C:\Users\Admin\AppData\Local\Temp\dc736e5e09d43f1c9a3a23f6cff45401.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\dc736e5e09d43f1c9a3a23f6cff45401.exe
  C:\Users\Admin\AppData\Local\Temp\dc736e5e09d43f1c9a3a23f6cff45401.exe
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\PXOR.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows \System32\Netplwiz.exe
    "C:\Windows \System32\Netplwiz.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Public\Cdex.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1048-19-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1316-2-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/2160-17-0x00007FF8D9B40000-0x00007FF8DA52C000-memory.dmp

Download

memory/2160-18-0x00000235C2680000-0x00000235C2681000-memory.dmp

Download

memory/2160-20-0x00000235C2730000-0x00000235C2732000-memory.dmp

Download

memory/2160-21-0x00000235C2733000-0x00000235C2735000-memory.dmp

Download

memory/2160-22-0x00000235C4710000-0x00000235C4711000-memory.dmp

Download

memory/2160-23-0x00000235C2736000-0x00000235C2738000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads