3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405

General

Target

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe
Size

44KB
MD5

5d7570aae6767d2abb357f59768d87ac
SHA1

2d56b12fcfcbae05f81340179f4b8346c850ec23
SHA256

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405
SHA512

510bfff94147245ec0943bcdf2ae9b3c76134bc5d10bd98e4a998f72e5fabd42d6c6da5cb3098436153933b5f4a125c8c1743e870874fc45f9165ec733a23920

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winsvc.exe

pid process

816 winsvc.exe
Loads dropped DLL 1 IoCs

Processes:

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

pid process

1552 3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

pid	process
816	winsvc.exe

pid	process
1552	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50508580580484050860586405\\winsvc.exe"	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50508580580484050860586405\\winsvc.exe"	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

Drops file in Windows directory 3 IoCs

Processes:

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

description	ioc	process
File created	C:\Windows\M-50508580580484050860586405\winsvc.exe	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe
File opened for modification	C:\Windows\M-50508580580484050860586405\winsvc.exe	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe
File opened for modification	C:\Windows\M-50508580580484050860586405	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe

description	pid	process	target process
PID 1552 wrote to memory of 816	1552	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe	winsvc.exe
PID 1552 wrote to memory of 816	1552	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe	winsvc.exe
PID 1552 wrote to memory of 816	1552	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe	winsvc.exe
PID 1552 wrote to memory of 816	1552	3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe	winsvc.exe

C:\Users\Admin\AppData\Local\Temp\3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe
"C:\Users\Admin\AppData\Local\Temp\3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\M-50508580580484050860586405\winsvc.exe
C:\Windows\M-50508580580484050860586405\winsvc.exe
2⤵
- Executes dropped EXE
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\M-50508580580484050860586405\winsvc.exe
Filesize
44KB

MD5
5d7570aae6767d2abb357f59768d87ac

SHA1
2d56b12fcfcbae05f81340179f4b8346c850ec23

SHA256
3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405

SHA512
510bfff94147245ec0943bcdf2ae9b3c76134bc5d10bd98e4a998f72e5fabd42d6c6da5cb3098436153933b5f4a125c8c1743e870874fc45f9165ec733a23920

Download Submit
\Windows\M-50508580580484050860586405\winsvc.exe
Filesize
44KB

MD5
5d7570aae6767d2abb357f59768d87ac

SHA1
2d56b12fcfcbae05f81340179f4b8346c850ec23

SHA256
3fa6a8ad5cede430a96feb1a9cd37693d47608eaa5f6adf89ea290871cc97405

SHA512
510bfff94147245ec0943bcdf2ae9b3c76134bc5d10bd98e4a998f72e5fabd42d6c6da5cb3098436153933b5f4a125c8c1743e870874fc45f9165ec733a23920

Download Submit
memory/816-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads