3d445366066d1c084f489995e476abe8e1204fa1918468868c4f90cabd2e5817

General

Target

lab_02_win10x64/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

putis.exeputis.exe

pid process

1456 putis.exe
1544 putis.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1624 cmd.exe

pid	process
1456	putis.exe
1544	putis.exe

pid	process
1624	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

pid	process
1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

putis.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\Currentversion\Run	putis.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run	putis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uvveku = "C:\\Users\\Admin\\AppData\\Roaming\\Zauci\\putis.exe"	putis.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exeputis.exe

description	pid	process	target process
PID 1824 set thread context of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1456 set thread context of 1544	1456	putis.exe	putis.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

putis.exe

pid	process
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe
1544	putis.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

description	pid	process
Token: SeSecurityPrivilege	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Token: SeSecurityPrivilege	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exeputis.exe

pid process

1824 a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
1456 putis.exe

pid	process
1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
1456	putis.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exea380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exeputis.exeputis.exe

description	pid	process	target process
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1824 wrote to memory of 1948	1824	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
PID 1948 wrote to memory of 1456	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	putis.exe
PID 1948 wrote to memory of 1456	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	putis.exe
PID 1948 wrote to memory of 1456	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	putis.exe
PID 1948 wrote to memory of 1456	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1456 wrote to memory of 1544	1456	putis.exe	putis.exe
PID 1948 wrote to memory of 1624	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	cmd.exe
PID 1948 wrote to memory of 1624	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	cmd.exe
PID 1948 wrote to memory of 1624	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	cmd.exe
PID 1948 wrote to memory of 1624	1948	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	cmd.exe
PID 1544 wrote to memory of 1120	1544	putis.exe	taskhost.exe
PID 1544 wrote to memory of 1120	1544	putis.exe	taskhost.exe
PID 1544 wrote to memory of 1120	1544	putis.exe	taskhost.exe
PID 1544 wrote to memory of 1120	1544	putis.exe	taskhost.exe
PID 1544 wrote to memory of 1120	1544	putis.exe	taskhost.exe
PID 1544 wrote to memory of 1172	1544	putis.exe	Dwm.exe
PID 1544 wrote to memory of 1172	1544	putis.exe	Dwm.exe
PID 1544 wrote to memory of 1172	1544	putis.exe	Dwm.exe
PID 1544 wrote to memory of 1172	1544	putis.exe	Dwm.exe
PID 1544 wrote to memory of 1172	1544	putis.exe	Dwm.exe
PID 1544 wrote to memory of 1212	1544	putis.exe	Explorer.EXE
PID 1544 wrote to memory of 1212	1544	putis.exe	Explorer.EXE
PID 1544 wrote to memory of 1212	1544	putis.exe	Explorer.EXE
PID 1544 wrote to memory of 1212	1544	putis.exe	Explorer.EXE
PID 1544 wrote to memory of 1212	1544	putis.exe	Explorer.EXE
PID 1544 wrote to memory of 1624	1544	putis.exe	cmd.exe
PID 1544 wrote to memory of 1624	1544	putis.exe	cmd.exe
PID 1544 wrote to memory of 1624	1544	putis.exe	cmd.exe
PID 1544 wrote to memory of 1624	1544	putis.exe	cmd.exe
PID 1544 wrote to memory of 1624	1544	putis.exe	cmd.exe
PID 1544 wrote to memory of 1080	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1080	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1080	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1080	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1080	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1112	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1112	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1112	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1112	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 1112	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 548	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 548	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 548	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 548	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 548	1544	putis.exe	DllHost.exe
PID 1544 wrote to memory of 828	1544	putis.exe	DllHost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
"C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
"C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe"
3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Roaming\Zauci\putis.exe
"C:\Users\Admin\AppData\Roaming\Zauci\putis.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Roaming\Zauci\putis.exe
"C:\Users\Admin\AppData\Roaming\Zauci\putis.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4e4ae851.bat"
4⤵
- Deletes itself
PID:1624

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1080

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:828

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1988

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1764

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:316

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4e4ae851.bat

MD5
3e371b494d23ae803c2ef29079ee7f53

SHA1
892332dc358b2659336f8249b113f4df38239f1c

SHA256
0e642c335f8327cb7a419077ec8c5562708aa8655ac23561d043e799d3a2f2b8

SHA512
33c98c84cf8749b9c953a8715dbf1f24d5ef32c0a082a65443fdf35666ca4527c878825bf4913453e72cac0939a653904d080958e03cd77c7222516108b44cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Zauci\putis.exe

MD5
bff261062bc66a547088385b86766b75

SHA1
079522e101ef2e720df42eb635a1de09adca744b

SHA256
9285d9c98df05bf6670038a8c29aee1ee72780911e29707cbb77e7cea95ddb79

SHA512
93d98a45590e2b7188dc2d8151906e66711ce0bc7b9f73de4dff305074ab83be0200df738dc6755b255251e1a215cdf2cfb03024f776db6d00483090d2f33216

Download Submit
C:\Users\Admin\AppData\Roaming\Zauci\putis.exe

MD5
bff261062bc66a547088385b86766b75

SHA1
079522e101ef2e720df42eb635a1de09adca744b

SHA256
9285d9c98df05bf6670038a8c29aee1ee72780911e29707cbb77e7cea95ddb79

SHA512
93d98a45590e2b7188dc2d8151906e66711ce0bc7b9f73de4dff305074ab83be0200df738dc6755b255251e1a215cdf2cfb03024f776db6d00483090d2f33216

Download Submit
C:\Users\Admin\AppData\Roaming\Zauci\putis.exe

MD5
bff261062bc66a547088385b86766b75

SHA1
079522e101ef2e720df42eb635a1de09adca744b

SHA256
9285d9c98df05bf6670038a8c29aee1ee72780911e29707cbb77e7cea95ddb79

SHA512
93d98a45590e2b7188dc2d8151906e66711ce0bc7b9f73de4dff305074ab83be0200df738dc6755b255251e1a215cdf2cfb03024f776db6d00483090d2f33216

Download Submit
\Users\Admin\AppData\Roaming\Zauci\putis.exe

MD5
bff261062bc66a547088385b86766b75

SHA1
079522e101ef2e720df42eb635a1de09adca744b

SHA256
9285d9c98df05bf6670038a8c29aee1ee72780911e29707cbb77e7cea95ddb79

SHA512
93d98a45590e2b7188dc2d8151906e66711ce0bc7b9f73de4dff305074ab83be0200df738dc6755b255251e1a215cdf2cfb03024f776db6d00483090d2f33216

Download Submit
\Users\Admin\AppData\Roaming\Zauci\putis.exe

MD5
bff261062bc66a547088385b86766b75

SHA1
079522e101ef2e720df42eb635a1de09adca744b

SHA256
9285d9c98df05bf6670038a8c29aee1ee72780911e29707cbb77e7cea95ddb79

SHA512
93d98a45590e2b7188dc2d8151906e66711ce0bc7b9f73de4dff305074ab83be0200df738dc6755b255251e1a215cdf2cfb03024f776db6d00483090d2f33216

Download Submit
memory/1456-70-0x0000000000000000-mapping.dmp

Download
memory/1544-78-0x000000000042B055-mapping.dmp

Download
memory/1624-81-0x0000000000000000-mapping.dmp

Download
memory/1824-62-0x0000000001B70000-0x0000000001B90000-memory.dmp

Filesize
128KB

Download
memory/1824-63-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1948-67-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1948-65-0x000000000042B055-mapping.dmp

Download
memory/1948-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads