b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0

General

Target

b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe
Size

202KB
MD5

89d7d4d58b8691bb4227caadd098a866
SHA1

66babca9673d34801bd59cd17f5a9bdb1f0fb72b
SHA256

b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0
SHA512

f340ac40f71ff5baf1e175be2ab8e0be72ad83e1c08d5cabf33e26baaffae6e090b2842638ad2c21464e739301a56d27c6c6ae4771e03ae7f1617db3e3c3ce44

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1904	winplgt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsServicesUpdates32 = "C:\\Windows\\5001489516019026\\winplgt.exe"	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsServicesUpdates32 = "C:\\Windows\\5001489516019026\\winplgt.exe"	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\5001489516019026\winplgt.exe	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe
File opened for modification	C:\Windows\5001489516019026	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe
File created	C:\Windows\5001489516019026\winplgt.exe	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1904	4688	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe	81
PID 4688 wrote to memory of 1904	4688	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe	81
PID 4688 wrote to memory of 1904	4688	b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe	81

C:\Users\Admin\AppData\Local\Temp\b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe
"C:\Users\Admin\AppData\Local\Temp\b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\5001489516019026\winplgt.exe
  C:\Windows\5001489516019026\winplgt.exe
  2⤵
  - Executes dropped EXE
  PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\5001489516019026\winplgt.exe

Filesize
202KB

MD5
89d7d4d58b8691bb4227caadd098a866

SHA1
66babca9673d34801bd59cd17f5a9bdb1f0fb72b

SHA256
b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0

SHA512
f340ac40f71ff5baf1e175be2ab8e0be72ad83e1c08d5cabf33e26baaffae6e090b2842638ad2c21464e739301a56d27c6c6ae4771e03ae7f1617db3e3c3ce44

Download Submit
C:\Windows\5001489516019026\winplgt.exe

Filesize
202KB

MD5
89d7d4d58b8691bb4227caadd098a866

SHA1
66babca9673d34801bd59cd17f5a9bdb1f0fb72b

SHA256
b6d8c4a6ea47d3402ad8ff1a5cf7c3b85396521a10a2049cc6a9e247290020e0

SHA512
f340ac40f71ff5baf1e175be2ab8e0be72ad83e1c08d5cabf33e26baaffae6e090b2842638ad2c21464e739301a56d27c6c6ae4771e03ae7f1617db3e3c3ce44

Download Submit
memory/1904-136-0x00000000007B1000-0x00000000007B5000-memory.dmp

Filesize
16KB

Download
memory/1904-137-0x00000000007B1000-0x00000000007B5000-memory.dmp

Filesize
16KB

Download
memory/1904-138-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4688-130-0x0000000000542000-0x0000000000547000-memory.dmp

Filesize
20KB

Download
memory/4688-131-0x0000000000542000-0x0000000000547000-memory.dmp

Filesize
20KB

Download
memory/4688-132-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download

Analysis

Sharing