8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc

General

Target
d0488c635bdf39e3670bccb70e240ef9.exe
Size 138KB
Sample220130-p6cslsbcgl
SHA256 8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc
MD5 d0488c635bdf39e3670bccb70e240ef9
SHA1 3deb0acc0a9d72202e38d1afcae265d4671489d8
SHA512 4370af21751cceffcbcdf37e9a6f36e404fd6eaab649e3dcb52a37fc0ee11c854539e08a711975f907b1c1ff577b9b13a659dfd0d008b089c26f85501e79a94f
SSDEEP 3072:Obvt5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YG:Obv7S7BqjjYHdrqkL/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\2717123927\1253081315.pri	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2796	d0488c635bdf39e3670bccb70e240ef9.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	d0488c635bdf39e3670bccb70e240ef9.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe
Token: SeShutdownPrivilege	3808	explorer.exe
Token: SeCreatePagefilePrivilege	3808	explorer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe
3808	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3808	2796	d0488c635bdf39e3670bccb70e240ef9.exe	69
PID 2796 wrote to memory of 3808	2796	d0488c635bdf39e3670bccb70e240ef9.exe	69
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 2796 wrote to memory of 3136	2796	d0488c635bdf39e3670bccb70e240ef9.exe	70
PID 3808 wrote to memory of 1308	3808	explorer.exe	73
PID 3808 wrote to memory of 1308	3808	explorer.exe	73

C:\Users\Admin\AppData\Local\Temp\d0488c635bdf39e3670bccb70e240ef9.exe
"C:\Users\Admin\AppData\Local\Temp\d0488c635bdf39e3670bccb70e240ef9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:1308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB
  2⤵
  PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-118-0x0000017A3EFB0000-0x0000017A3EFD8000-memory.dmp

Download

memory/3136-119-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3136-190-0x0000000006D80000-0x0000000006E12000-memory.dmp

Download

memory/3136-195-0x00000000094F0000-0x000000000958C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads