7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9

General

Target

7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe
Size

3.3MB
MD5

5fdb4467d3af6354416696aeab904fe3
SHA1

a6faa74248c429e454744e0d8de759b5ec4ee6e6
SHA256

7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9
SHA512

e39a36b691346f489673c5d3656d8d7208a893e48a3f5b714aebad0640864af21854777865e9a8c91ed2bd845621c1d98703a27be1a6ccf1bcade3a05889a215

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CDS.exe

pid process

1868 CDS.exe
Loads dropped DLL 1 IoCs

Processes:

CDS.exe

pid process

1868 CDS.exe

pid	process
1868	CDS.exe

pid	process
1868	CDS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CDS.exe

pid process

1868 CDS.exe

pid	process
1868	CDS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe

description	pid	process	target process
PID 1948 wrote to memory of 1868	1948	7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe	CDS.exe
PID 1948 wrote to memory of 1868	1948	7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe	CDS.exe
PID 1948 wrote to memory of 1868	1948	7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe	CDS.exe

C:\Users\Admin\AppData\Local\Temp\7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe
"C:\Users\Admin\AppData\Local\Temp\7a535a6d9d4925e4c30b23a00bee6e90f50e69e2d7fa702e49b5bc7b7ec770f9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x470
1⤵
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd
Filesize
11KB

MD5
b432459b170a1ae37650961fffffffb4

SHA1
79805ef9e94af9f7698eae523402baab7aa592c8

SHA256
a014a40ce535cf3263ff788d568b2d97c8a8a32d6e6be0f8cbd9c9d9da95e991

SHA512
0348d14c15c05aac55a95722aff6c21ba7e06ff40e24fd3d49e99550c7d787bb9582716e665c74136582777cbc79ae0d68576509158fad7861290c5fa02430c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
Filesize
23KB

MD5
89b53ef665a9832e085ed63fa1c789c5

SHA1
af564644c8dc563e772e6b155a78c9d38fcad8f8

SHA256
65efe72149db69fd022511ebda3e54435f72ed2d62e4451f69476daa72b455e8

SHA512
424caf696855d5548dd5f28e5f9929edb30bc993aca9b9f42dcedb73c8ff0cd3a5ab82a032c0f2ee10263550a78fa2589bec806ab2b22f8f11daeea3711d62d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
Filesize
9KB

MD5
5ea4dda9ba2f7ed8249c89fc39ed1f6e

SHA1
cbde70eca8c895051526200e0102d5f7d7180e79

SHA256
225fe248b488bc69d5176273719d0c8c53d8d464db395b5b7930cba2c631abae

SHA512
a28475c7bff3f648dfd50219c280a5d69b88b697426b7786b06f687f77c427797c84ca2cdce2fa665eda2ff662e2478652c6db3a36807e71e7b4cc88b2727b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
Filesize
16KB

MD5
a75d3a066b535afa672b1f0e203b2d8d

SHA1
c983856fe04a089add71db6a3f5f40686275387d

SHA256
4ad5bd98c2b4b9f1148d374b114e53700405669183532a170953842d39f04c73

SHA512
7a4b716cd211e09d41b035854a32e847c62c3ecad1962bf27175b1f52b68be7637b6cb9161d4bbce2754491722d967c31b0f46bfc54cd1da95ad503fd007ca8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1868-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing