0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

General

Target

11379015582786627911.exe
Size

6.6MB
MD5

a2d7280fb1a88819932e1a73a38542f0
SHA1

0682680b071988c34e3c8eecb12aafd7df4ade0d
SHA256

0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15
SHA512

c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830
SSDEEP

196608:CTLUG3f2675rSEEfCEQlj3QnXF0zswkLdKSEtaC:CXnf2675rYAGUdSRC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1592	PerfWatson2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1992	11379015582786627911.exe
1992	11379015582786627911.exe
1592	PerfWatson2.exe
1592	PerfWatson2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	1992	WerFault.exe	25

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1976	schtasks.exe
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	11379015582786627911.exe
1592	PerfWatson2.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1976	1992	11379015582786627911.exe	26
PID 1992 wrote to memory of 1976	1992	11379015582786627911.exe	26
PID 1992 wrote to memory of 1976	1992	11379015582786627911.exe	26
PID 1992 wrote to memory of 1976	1992	11379015582786627911.exe	26
PID 1992 wrote to memory of 936	1992	11379015582786627911.exe	28
PID 1992 wrote to memory of 936	1992	11379015582786627911.exe	28
PID 1992 wrote to memory of 936	1992	11379015582786627911.exe	28
PID 1992 wrote to memory of 936	1992	11379015582786627911.exe	28
PID 1992 wrote to memory of 1532	1992	11379015582786627911.exe	31
PID 1992 wrote to memory of 1532	1992	11379015582786627911.exe	31
PID 1992 wrote to memory of 1532	1992	11379015582786627911.exe	31
PID 1992 wrote to memory of 1532	1992	11379015582786627911.exe	31
PID 1348 wrote to memory of 1592	1348	taskeng.exe	33
PID 1348 wrote to memory of 1592	1348	taskeng.exe	33
PID 1348 wrote to memory of 1592	1348	taskeng.exe	33
PID 1348 wrote to memory of 1592	1348	taskeng.exe	33

C:\Users\Admin\AppData\Local\Temp\11379015582786627911.exe
"C:\Users\Admin\AppData\Local\Temp\11379015582786627911.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1976
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}"
  2⤵
  PID:936
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 192
  2⤵
  - Program crash
  PID:1532

C:\Windows\system32\taskeng.exe
taskeng.exe {37B16C84-5A07-4BE8-B9D4-2C7163D627A3} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe

Filesize
6.6MB

MD5
a2d7280fb1a88819932e1a73a38542f0

SHA1
0682680b071988c34e3c8eecb12aafd7df4ade0d

SHA256
0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

SHA512
c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe

Filesize
6.6MB

MD5
a2d7280fb1a88819932e1a73a38542f0

SHA1
0682680b071988c34e3c8eecb12aafd7df4ade0d

SHA256
0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

SHA512
c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830

Download Submit
memory/1592-64-0x0000000000C40000-0x0000000001679000-memory.dmp

Filesize
10.2MB

Download
memory/1592-65-0x0000000000C40000-0x0000000001679000-memory.dmp

Filesize
10.2MB

Download
memory/1592-66-0x0000000000C40000-0x0000000001679000-memory.dmp

Filesize
10.2MB

Download
memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000B50000-0x0000000001589000-memory.dmp

Filesize
10.2MB

Download
memory/1992-56-0x0000000000B50000-0x0000000001589000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads