6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734

General

Target

6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Size

114KB
MD5

d13f27532e3763fdc015616ba5388c4a
SHA1

19bab590540b23a2bcaf9533df8e566ec9512640
SHA256

6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734
SHA512

b9d598187a29341f64bb612c6e8a350a7a8e496f303c5e026ba75d49b991dfcf977d217aa1477650f86e23ad48e6c18b5c03f63e193fdad8df70230d9ef46cd3

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 myexternalip.com
4 myexternalip.com

flow	ioc
2	myexternalip.com
4	myexternalip.com

Modifies data under HKEY_USERS 42 IoCs

Processes:

6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2020 wrote to memory of 1592	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
PID 2020 wrote to memory of 1592	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
PID 2020 wrote to memory of 1592	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
PID 2020 wrote to memory of 468	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
PID 2020 wrote to memory of 468	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
PID 2020 wrote to memory of 468	2020	taskeng.exe	6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe

C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
"C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe"
1⤵
PID:1904

C:\Windows\system32\taskeng.exe
taskeng.exe {2BE4A707-9C3B-4904-97A7-B357AED5EC01} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
2⤵
- Modifies data under HKEY_USERS
PID:1592

C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
C:\Users\Admin\AppData\Local\Temp\6c4609a6655bac0b7a06c570772fbd6d2ef0e8c02ef38e35c10f17c7a245b734.exe
2⤵
PID:468

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads