bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9

General

Target

bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe
Size

136KB
MD5

45b0c26381240ecdaf34e19fe675924b
SHA1

2470028adb9bc1d6a03c363fbc82e3a811620362
SHA256

bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9
SHA512

55efb387c76e3f5c3ef04724acb603f50b492415f59b33353b36b83332b12e0ed72ca8411859cdc99042069323d1b27301fc6f4a8d9f95a832374ccfdb7bea6b

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sihost.exe

pid process

736 sihost.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

812 schtasks.exe
1120 schtasks.exe

pid	process
736	sihost.exe

pid	process
812	schtasks.exe
1120	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exesihost.exe

description	pid	process	target process
PID 636 wrote to memory of 812	636	bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe	schtasks.exe
PID 636 wrote to memory of 812	636	bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe	schtasks.exe
PID 636 wrote to memory of 812	636	bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe	schtasks.exe
PID 736 wrote to memory of 1120	736	sihost.exe	schtasks.exe
PID 736 wrote to memory of 1120	736	sihost.exe	schtasks.exe
PID 736 wrote to memory of 1120	736	sihost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe
"C:\Users\Admin\AppData\Local\Temp\bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
2⤵
- Creates scheduled task(s)
PID:812

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
2⤵
- Creates scheduled task(s)
PID:1120

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
MD5
45b0c26381240ecdaf34e19fe675924b

SHA1
2470028adb9bc1d6a03c363fbc82e3a811620362

SHA256
bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9

SHA512
55efb387c76e3f5c3ef04724acb603f50b492415f59b33353b36b83332b12e0ed72ca8411859cdc99042069323d1b27301fc6f4a8d9f95a832374ccfdb7bea6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
MD5
45b0c26381240ecdaf34e19fe675924b

SHA1
2470028adb9bc1d6a03c363fbc82e3a811620362

SHA256
bd44515c1a3cd96354a16d739071ceb94173a695c062620c22b34e68920979c9

SHA512
55efb387c76e3f5c3ef04724acb603f50b492415f59b33353b36b83332b12e0ed72ca8411859cdc99042069323d1b27301fc6f4a8d9f95a832374ccfdb7bea6b

Download Submit
memory/636-115-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/636-114-0x0000000000610000-0x0000000000614000-memory.dmp

Filesize
16KB

Download
memory/736-121-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/736-120-0x00000000004B0000-0x000000000055E000-memory.dmp

Filesize
696KB

Download
memory/812-116-0x0000000000000000-mapping.dmp

Download
memory/1120-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads