111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641

General

Target
111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe
Size 426KB
Sample220604-k7hb9schgp
SHA256 111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641
MD5 79dbbe2f3e73d24d661219c593a8bfa1
SHA1 e9b2994905b29235881c8cb7ce7af6e96ec89d54
SHA512 29d77ff3893f350a8bad4be8eebe53154b00cee6539ec10d6f7a0dbfb861255fccf9efc34adee45a3a80daf3e154edbc871a3ad0d9c8c493b84c36b5ffa97737
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1420	update.exe
2272	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1420	update.exe
2272	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1420	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	81
PID 1868 wrote to memory of 1420	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	81
PID 1868 wrote to memory of 1420	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	81
PID 1868 wrote to memory of 2272	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	83
PID 1868 wrote to memory of 2272	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	83
PID 1868 wrote to memory of 2272	1868	111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe	83

C:\Users\Admin\AppData\Local\Temp\111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe
"C:\Users\Admin\AppData\Local\Temp\111e6fb4fa87fa887a993c4284c4d0c05a608af2e82807ef0c06a99a450fd641.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
Size 364KB
SHA256 50e62fb4f9bcea5fd1dcae38850fd3ceae0bcb2f5d2c493a5b71660a5e40f02c
MD5 79218fdb0792057f38131de2cbb82d53
SHA1 7e1db5200abde22cbc759f00c8f24769aae4949b
SHA512 e3f57a655c025a3c1efa9d78477d367b54257e02e642659b4476acec92b1f0388839904742dd438867cc8d8182d5367f82c3077134fd33923c18df46d60e47d7
SSDEEP 6144:RoLBetZgefR3TLep+IHwFNp+EXaTVLuNuTNf1gYCWimkNAGMvVldV3aWoWYs:RTZgOheUIQFNLcMNeNfSYtiLAGMvV1ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
Size 364KB
SHA256 50e62fb4f9bcea5fd1dcae38850fd3ceae0bcb2f5d2c493a5b71660a5e40f02c
MD5 79218fdb0792057f38131de2cbb82d53
SHA1 7e1db5200abde22cbc759f00c8f24769aae4949b
SHA512 e3f57a655c025a3c1efa9d78477d367b54257e02e642659b4476acec92b1f0388839904742dd438867cc8d8182d5367f82c3077134fd33923c18df46d60e47d7
SSDEEP 6144:RoLBetZgefR3TLep+IHwFNp+EXaTVLuNuTNf1gYCWimkNAGMvVldV3aWoWYs:RTZgOheUIQFNLcMNeNfSYtiLAGMvV1ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
Size 104KB
SHA256 f2e92b84166c84b2a09852e1d0240af405bd636c97d523277b7e0ffe79db5d3d
MD5 edce79646c95a9195091d4faad7d566d
SHA1 39a621151218df86577d9a6b9b43649166c72e72
SHA512 d27cec9b0802320055ab596ea7798401a474b48df3fa300b542e270121c8b4b5528b767317b495efce303d2d00ffbe8e1faa955049489ea0f89b8a1ab461adf8
SSDEEP 1536:D6QCxZyzT81RL0Q8toN4TOvfaOiGLLZOiniREo0ORbtkFBJYSGHs+gappADR:DFCbB1RL0DEaOiG/Zq50ubOlGHs+gaYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
Size 104KB
SHA256 f2e92b84166c84b2a09852e1d0240af405bd636c97d523277b7e0ffe79db5d3d
MD5 edce79646c95a9195091d4faad7d566d
SHA1 39a621151218df86577d9a6b9b43649166c72e72
SHA512 d27cec9b0802320055ab596ea7798401a474b48df3fa300b542e270121c8b4b5528b767317b495efce303d2d00ffbe8e1faa955049489ea0f89b8a1ab461adf8
SSDEEP 1536:D6QCxZyzT81RL0Q8toN4TOvfaOiGLLZOiniREo0ORbtkFBJYSGHs+gappADR:DFCbB1RL0DEaOiG/Zq50ubOlGHs+gaYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1420-133-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1420-134-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1420-137-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2272-143-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads