2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

General

Target

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
Size

187KB
MD5

b493b808ebd71c67996645db038807e4
SHA1

8c9bae6be1e3739c3b55a0726474d062332ee88b
SHA256

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f
SHA512

7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winicpn.exe

pid process

1804 winicpn.exe

pid	process
1804	winicpn.exe

Loads dropped DLL 2 IoCs

Processes:

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

pid	process
1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 97865 = "C:\\Windows\\7310414511756796\\winicpn.exe"	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update 97865 = "C:\\Windows\\7310414511756796\\winicpn.exe"	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

Drops file in Windows directory 3 IoCs

Processes:

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

description	ioc	process
File created	C:\Windows\7310414511756796\winicpn.exe	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
File opened for modification	C:\Windows\7310414511756796\winicpn.exe	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
File opened for modification	C:\Windows\7310414511756796	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe

description	pid	process	target process
PID 1100 wrote to memory of 1804	1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	winicpn.exe
PID 1100 wrote to memory of 1804	1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	winicpn.exe
PID 1100 wrote to memory of 1804	1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	winicpn.exe
PID 1100 wrote to memory of 1804	1100	2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe	winicpn.exe

C:\Users\Admin\AppData\Local\Temp\2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe
"C:\Users\Admin\AppData\Local\Temp\2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\7310414511756796\winicpn.exe
C:\Windows\7310414511756796\winicpn.exe
2⤵
- Executes dropped EXE
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\7310414511756796\winicpn.exe

Filesize
187KB

MD5
b493b808ebd71c67996645db038807e4

SHA1
8c9bae6be1e3739c3b55a0726474d062332ee88b

SHA256
2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

SHA512
7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Download Submit
\Windows\7310414511756796\winicpn.exe

Filesize
187KB

MD5
b493b808ebd71c67996645db038807e4

SHA1
8c9bae6be1e3739c3b55a0726474d062332ee88b

SHA256
2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

SHA512
7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Download Submit
\Windows\7310414511756796\winicpn.exe

Filesize
187KB

MD5
b493b808ebd71c67996645db038807e4

SHA1
8c9bae6be1e3739c3b55a0726474d062332ee88b

SHA256
2ed8dc993fdf20350c7269df368699bc737391ffb03807171a4225a07337b42f

SHA512
7abde54858086a9d16d0cf430d7eb6ec413e259b56ed0e946103f812056a7423db24779e38c2f73fdc7ff047797f2ddf99600708155e03b274a4bd2c1fd58c2e

Download Submit
memory/1100-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x00000000006B4000-0x00000000006B8000-memory.dmp

Filesize
16KB

Download
memory/1100-56-0x00000000006B4000-0x00000000006B8000-memory.dmp

Filesize
16KB

Download
memory/1100-57-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1804-60-0x0000000000000000-mapping.dmp

Download
memory/1804-63-0x0000000000794000-0x0000000000798000-memory.dmp

Filesize
16KB

Download
memory/1804-64-0x0000000000794000-0x0000000000798000-memory.dmp

Filesize
16KB

Download
memory/1804-65-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads