4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0

General

Target

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Size

423KB
MD5

465684a387882a2967ab06480bbd5e41
SHA1

ca5de6208c51538cfd9658db7831194fc4ee928a
SHA256

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0
SHA512

bab8fa9a91a88ea7bdd814d2b0046586c7d4b845d750af00b50b147db3b25ba4fabc3bacc2f78b1cd361c45ed585f0cd69d7c3ac7a9b21bfa4ecbbcc42d4b088

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\WINSXS32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

description	pid	process	target process
PID 1776 set thread context of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 set thread context of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 set thread context of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

pid process

2008 4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

pid	process
2008	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
"C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
NdxUsil.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008

C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
NdxUsil.exe
2⤵
- Adds Run key to start application
PID:1224

C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
bitcoin-miner.exe -a 60 -l no -o http://kdusd.cantvenlinea.biz:1942/ -u zephyr.oioioioioioioioi -p Nu778800
2⤵
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-65-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1224-73-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1224-71-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1224-63-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1224-68-0x0000000000401037-mapping.dmp

Download
memory/1224-64-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1224-66-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1628-80-0x00000000004F0000-0x000000000053C000-memory.dmp

Filesize
304KB

Download
memory/1628-81-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1628-90-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/1628-88-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/1628-83-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1628-84-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/1628-79-0x00000000004F0000-0x000000000053C000-memory.dmp

Filesize
304KB

Download
memory/1628-82-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/1628-74-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1628-72-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1628-70-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1628-76-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1628-77-0x0000000000401000-mapping.dmp

Download
memory/1628-78-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/1776-54-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1776-55-0x0000000000300000-0x000000000036F000-memory.dmp

Filesize
444KB

Download
memory/1776-89-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2008-62-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2008-56-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2008-57-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2008-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2008-59-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2008-60-0x0000000000401037-mapping.dmp

Download

description	pid	process	target process
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 2008	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1224	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
PID 1776 wrote to memory of 1628	1776	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads