e913efef17e825fea233b2718e80eeb7964ffc0abf8b6732bec99685474fc9c0

General

Target
file.exe
Size 2.0MB
Sample220822-skk4mscdh2
SHA256 e913efef17e825fea233b2718e80eeb7964ffc0abf8b6732bec99685474fc9c0
MD5 56a24c1b8b9034c745eb692c7749c0da
SHA1 812d13da81924ddfb773429be16d33f987ebf676
SHA512 0ab79f173c007888cf77a7aed8d57dcaf6fd0763fef5e15de7bae37b06f0314ff0cfd16383b3800421c922612266a74958a215876302597be80f3ca3811fd73f
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3756	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	conhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	conhost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe
3756	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4344	1528	file.exe	84
PID 1528 wrote to memory of 4344	1528	file.exe	84
PID 1528 wrote to memory of 4344	1528	file.exe	84
PID 4344 wrote to memory of 3756	4344	cmd.exe	86
PID 4344 wrote to memory of 3756	4344	cmd.exe	86
PID 4344 wrote to memory of 3756	4344	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bitcdbbvxo.bat 16492123483
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lyxgigk.dat 16492123483
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bitcdbbvxo.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bitcdbbvxo.bat
Size 75B
SHA256 36db82a6ce9d6b446b18430f1c74f37032e33bc7ab6fa05ff6d295c5f39e7901
MD5 58fbe2eb422052c7a41412696fb4aa7b
SHA1 83e14af8aa58741ace6b345baa544c0bccbfda08
SHA512 5bf3c7eed94127b23de35bca281ce9825e62636f6b94dff8162fb94250e3297d2f0d1553b35c8628c8e002b29c77fc7ee250bd7ef67350ac59aba00fdc3b3ec5
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 6a6ce9cbc42560a1d0ed9c04dcdcb84127f0c2e90d4850fd0e3003b31549795c
MD5 11f0b4e17e686cdc46f85a6becede4a8
SHA1 2826f7ac33b43439ecddd08ad541a7f54a9eb7c0
SHA512 11a321cc6685f854544a5228ae27cf311cf7ccc534be5255b4a6e6976c3d3c6ebe9d0873f8af0ad409d7893ea616754ebbf917e561d84bc22e81e030af4d084f
SSDEEP 49152:NJndCamYwAT6Lp1guCZ33jLZW4dq891dkVnjUdwENoYdoEDWCpjAFQMTAE6gpPyi:NJsam3APuCZ33jY4dqgCzjiRyIoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 6a6ce9cbc42560a1d0ed9c04dcdcb84127f0c2e90d4850fd0e3003b31549795c
MD5 11f0b4e17e686cdc46f85a6becede4a8
SHA1 2826f7ac33b43439ecddd08ad541a7f54a9eb7c0
SHA512 11a321cc6685f854544a5228ae27cf311cf7ccc534be5255b4a6e6976c3d3c6ebe9d0873f8af0ad409d7893ea616754ebbf917e561d84bc22e81e030af4d084f
SSDEEP 49152:NJndCamYwAT6Lp1guCZ33jLZW4dq891dkVnjUdwENoYdoEDWCpjAFQMTAE6gpPyi:NJsam3APuCZ33jY4dqgCzjiRyIoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

etbjefodwk.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\etbjefodwk.dat
Size 5.2MB
SHA256 6a6ce9cbc42560a1d0ed9c04dcdcb84127f0c2e90d4850fd0e3003b31549795c
MD5 11f0b4e17e686cdc46f85a6becede4a8
SHA1 2826f7ac33b43439ecddd08ad541a7f54a9eb7c0
SHA512 11a321cc6685f854544a5228ae27cf311cf7ccc534be5255b4a6e6976c3d3c6ebe9d0873f8af0ad409d7893ea616754ebbf917e561d84bc22e81e030af4d084f
SSDEEP 49152:NJndCamYwAT6Lp1guCZ33jLZW4dq891dkVnjUdwENoYdoEDWCpjAFQMTAE6gpPyi:NJsam3APuCZ33jY4dqgCzjiRyIoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyxgigk.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lyxgigk.dat
Size 272KB
SHA256 8b8533d5dd43ebe40bb9cd72056aba796e35278a5fb53d7bc40cce5ec6334537
MD5 fdd240a41cdf22c370a7f184e61f0ecc
SHA1 11d9f5bd15108cc06d595bf1354838e0c7a93a77
SHA512 b214a6b1b33ffd886f698a4628086330a9b4ecd2092aa6db6824907e7895fecd1b87cb05dd1fbbc2b377611e6a7282c9278ae4bf30fb7c86ce50da7f4c7c6457
SSDEEP 6144:McNF2ZqwZh/lO/KK+rpL7ERj9QQQILUleVgtvm957oTLkzsmWKKyra9c:McNsEyq+VEt9KAVeTupKUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads