A582F8176C5F4BECF5F95A563E9EC11A.exe

General
Target

A582F8176C5F4BECF5F95A563E9EC11A.exe

Filesize

1MB

Completed

25-07-2021 03:44

Score
7 /10
MD5

a582f8176c5f4becf5f95a563e9ec11a

SHA1

a8b2fd3f57157cce4fe9442b8ffa53e15ca4820c

SHA256

bd62e723aff056a5f6dd9b9ece4f5ea4bae0a50cc3bdd5f4228fb265c2a96170

Malware Config
Signatures 4

Filter: none

  • Drops startup file
    PowerShell.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koleno.exePowerShell.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koleno.exePowerShell.exe
  • Suspicious behavior: EnumeratesProcesses
    A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe

    Reported IOCs

    pidprocess
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    1644PowerShell.exe
    1644PowerShell.exe
  • Suspicious use of AdjustPrivilegeToken
    A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1996A582F8176C5F4BECF5F95A563E9EC11A.exe
    Token: SeDebugPrivilege1644PowerShell.exe
  • Suspicious use of WriteProcessMemory
    A582F8176C5F4BECF5F95A563E9EC11A.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1996 wrote to memory of 16441996A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe
    PID 1996 wrote to memory of 16441996A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe
    PID 1996 wrote to memory of 16441996A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe
    PID 1996 wrote to memory of 16441996A582F8176C5F4BECF5F95A563E9EC11A.exePowerShell.exe
    PID 1996 wrote to memory of 7401996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7401996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7401996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7401996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 2961996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 2961996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 2961996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 2961996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5921996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5921996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5921996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5921996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5721996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5721996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5721996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 5721996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7121996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7121996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7121996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
    PID 1996 wrote to memory of 7121996A582F8176C5F4BECF5F95A563E9EC11A.exeA582F8176C5F4BECF5F95A563E9EC11A.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
    "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koleno.exe'
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      PID:740
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      PID:296
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      PID:592
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      PID:572
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      PID:712
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1644-72-0x0000000005240000-0x0000000005241000-memory.dmp

                          • memory/1644-88-0x0000000006280000-0x0000000006281000-memory.dmp

                          • memory/1644-62-0x0000000000000000-mapping.dmp

                          • memory/1644-81-0x00000000061D0000-0x00000000061D1000-memory.dmp

                          • memory/1644-65-0x00000000021F0000-0x00000000021F1000-memory.dmp

                          • memory/1644-66-0x00000000047A0000-0x00000000047A1000-memory.dmp

                          • memory/1644-80-0x00000000056B0000-0x00000000056B1000-memory.dmp

                          • memory/1644-69-0x0000000004762000-0x0000000004763000-memory.dmp

                          • memory/1644-68-0x0000000004760000-0x0000000004761000-memory.dmp

                          • memory/1644-75-0x0000000005660000-0x0000000005661000-memory.dmp

                          • memory/1644-71-0x0000000002490000-0x0000000002491000-memory.dmp

                          • memory/1644-89-0x000000007EF30000-0x000000007EF31000-memory.dmp

                          • memory/1996-70-0x0000000000530000-0x0000000000531000-memory.dmp

                          • memory/1996-67-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                          • memory/1996-64-0x0000000000340000-0x0000000000355000-memory.dmp

                          • memory/1996-61-0x0000000075D41000-0x0000000075D43000-memory.dmp

                          • memory/1996-59-0x0000000000370000-0x0000000000371000-memory.dmp