3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd

General

Target

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe
Size

45KB
MD5

e489248bf961352d6af07e6a3132ff45
SHA1

abdb9566d08c5af8132dd093dabdc9b2124fc063
SHA256

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd
SHA512

11788b039870746d551f5f2a71400ef29fc9a2f5ee8ea5ed6564904007f73549b6e0cfafa69c3062ac39d83920984315a496e7269bf5f6b0faf644e4b94b464a

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winsvc.exe

pid process

1528 winsvc.exe
Loads dropped DLL 1 IoCs

Processes:

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

pid process

764 3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

pid	process
1528	winsvc.exe

pid	process
764	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-5050804050608540600846065906\\winsvc.exe"	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-5050804050608540600846065906\\winsvc.exe"	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

Drops file in Windows directory 3 IoCs

Processes:

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

description	ioc	process
File created	C:\Windows\M-5050804050608540600846065906\winsvc.exe	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe
File opened for modification	C:\Windows\M-5050804050608540600846065906\winsvc.exe	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe
File opened for modification	C:\Windows\M-5050804050608540600846065906	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe

description	pid	process	target process
PID 764 wrote to memory of 1528	764	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe	winsvc.exe
PID 764 wrote to memory of 1528	764	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe	winsvc.exe
PID 764 wrote to memory of 1528	764	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe	winsvc.exe
PID 764 wrote to memory of 1528	764	3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe	winsvc.exe

C:\Users\Admin\AppData\Local\Temp\3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe
"C:\Users\Admin\AppData\Local\Temp\3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\M-5050804050608540600846065906\winsvc.exe
C:\Windows\M-5050804050608540600846065906\winsvc.exe
2⤵
- Executes dropped EXE
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\M-5050804050608540600846065906\winsvc.exe
Filesize
45KB

MD5
e489248bf961352d6af07e6a3132ff45

SHA1
abdb9566d08c5af8132dd093dabdc9b2124fc063

SHA256
3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd

SHA512
11788b039870746d551f5f2a71400ef29fc9a2f5ee8ea5ed6564904007f73549b6e0cfafa69c3062ac39d83920984315a496e7269bf5f6b0faf644e4b94b464a

Download Submit
\Windows\M-5050804050608540600846065906\winsvc.exe
Filesize
45KB

MD5
e489248bf961352d6af07e6a3132ff45

SHA1
abdb9566d08c5af8132dd093dabdc9b2124fc063

SHA256
3e1665aa7d0e5097773b0c05671dcda6d39f1350a1d50d2d7a89c932ba99f9dd

SHA512
11788b039870746d551f5f2a71400ef29fc9a2f5ee8ea5ed6564904007f73549b6e0cfafa69c3062ac39d83920984315a496e7269bf5f6b0faf644e4b94b464a

Download Submit
memory/1528-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads