ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0

General

Target

SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
Size

1.3MB
MD5

8d4f45dd9a5b28f07fd1e3b1067de4b0
SHA1

a26b4056669b0866d248e6c5a6a29de4f41314ef
SHA256

ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0
SHA512

aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

236BC027.exe236BC027.exe

pid process

592 236BC027.exe
948 236BC027.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe

pid process

784 SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe

pid	process
592	236BC027.exe
948	236BC027.exe

pid	process
784	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{ECA6763D-C785-4391-B2DD-A67E491A469F} = "C:\\ProgramData\\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\\236BC027.exe"	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{ECA6763D-C785-4391-B2DD-A67E491A469F} = "C:\\ProgramData\\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\\236BC027.exe"	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe236BC027.exe

description	pid	process	target process
PID 484 set thread context of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 592 set thread context of 948	592	236BC027.exe	236BC027.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exeSecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe236BC027.exe

description	pid	process	target process
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 484 wrote to memory of 784	484	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
PID 784 wrote to memory of 592	784	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	236BC027.exe
PID 784 wrote to memory of 592	784	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	236BC027.exe
PID 784 wrote to memory of 592	784	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	236BC027.exe
PID 784 wrote to memory of 592	784	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe
PID 592 wrote to memory of 948	592	236BC027.exe	236BC027.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe
    "C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe

MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0

SHA1
a26b4056669b0866d248e6c5a6a29de4f41314ef

SHA256
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0

SHA512
aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca

Download Submit
C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe

MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0

SHA1
a26b4056669b0866d248e6c5a6a29de4f41314ef

SHA256
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0

SHA512
aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca

Download Submit
C:\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe

MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0

SHA1
a26b4056669b0866d248e6c5a6a29de4f41314ef

SHA256
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0

SHA512
aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBAB0F817E2442749C86ABA

MD5
e52c0a3d3d42dfb15b61fd9cbbf245fa

SHA1
2626d7a0c22d59d508a13a70c96c7e0e704f4c3b

SHA256
a48d390098acdbe46053554028aa5c1b3d648dcedaceb3baad3241c2600166e8

SHA512
78fb9f8808f553322d1c39f735957faf1981879c85a6f70c1608d0399f123a349168a3a07a8677d71e44b99ca48c4550e39704096ba4da929ce86025f1bfe637

Download Submit
\ProgramData\{3C99F7C5-B75C-419E-B980-D0CECB88D8B3}\236BC027.exe

MD5
8d4f45dd9a5b28f07fd1e3b1067de4b0

SHA1
a26b4056669b0866d248e6c5a6a29de4f41314ef

SHA256
ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0

SHA512
aa577b037371b8c4695e4d12a0d45553584602dd00a475037ae8f42ee360b40dc5fa6309242ccc2b8a282f43144e75e8d0785fb7bc8e2919570977fa1794fdca

Download Submit
memory/484-65-0x0000000005BF0000-0x0000000005CA3000-memory.dmp

Filesize
716KB

Download
memory/484-60-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/484-64-0x00000000080E0000-0x00000000081DC000-memory.dmp

Filesize
1008KB

Download
memory/484-63-0x00000000005B0000-0x00000000005B2000-memory.dmp

Filesize
8KB

Download
memory/484-62-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/592-70-0x0000000000000000-mapping.dmp

Download
memory/592-73-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/592-77-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/784-67-0x00000000004537AF-mapping.dmp

Download
memory/784-68-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/784-66-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/784-76-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/948-81-0x00000000004537AF-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads