2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433

General

Target

2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
Size

28KB
MD5

e16bc0c5ee912173dd6e01e1457694fd
SHA1

904fa2f0463d6b4dc3694d5481eadea439db3cf9
SHA256

2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433
SHA512

7c7de1a93cb8f3128d16c8e29472ec158cf861c25f989941a9c00fe34100583c21c3713a8e961a6661a357e5c7cae0315e42925fbb8c312d9e4d3d7ef2c09836
SSDEEP

384:qbrnLOWQtVDw623yj2K7ICqggAaCYG3uFdx+OabUF3kKgcGIbTaUOhX5YMDnNYJJ:6rd/K7rEFabU9kKXHbShXqcn4Lgq

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	~24058840.exe

Executes dropped EXE 1 IoCs

pid	Process
224	~24058840.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "services.exe"	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1156-132-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/1156-133-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfigs = "C:\\Windows\\system32\\eMaoY.exe"	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfigs = "C:\\Windows\\system32\\eMaoY.exe"	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eMaoY.exe	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe
224	~24058840.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 224	1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe	87
PID 1156 wrote to memory of 224	1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe	87
PID 1156 wrote to memory of 224	1156	2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe	87
PID 224 wrote to memory of 4820	224	~24058840.exe	88
PID 224 wrote to memory of 4820	224	~24058840.exe	88
PID 224 wrote to memory of 4820	224	~24058840.exe	88

C:\Users\Admin\AppData\Local\Temp\2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe
"C:\Users\Admin\AppData\Local\Temp\2a7663ea892a178847e089d5beb65e7371e1abfa7c1fa52ad54282dbd7258433.exe"
1⤵
- Sets file execution options in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\~24058840.exe
  C:\Users\Admin\AppData\Local\Temp\~24058840.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    PID:4820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~24058840.exe

Filesize
8KB

MD5
8377d2dc32a43d55efb75e5cba47422e

SHA1
a376a12372dd1908773326bc30bc3300b082c291

SHA256
962ecf776c2599788c494d8ccf658461487072b6eda51c999ab09ef62555cdf4

SHA512
66a551b31cd649f8ce3d23ceb3bcf1efd5f4583fa1d4dd83e73a4cde6461be46c3d9bd69deb462817b7252a774b937c35a4635bcdf2b8e1287e0a51d6cb791ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\~24058840.exe

Filesize
8KB

MD5
8377d2dc32a43d55efb75e5cba47422e

SHA1
a376a12372dd1908773326bc30bc3300b082c291

SHA256
962ecf776c2599788c494d8ccf658461487072b6eda51c999ab09ef62555cdf4

SHA512
66a551b31cd649f8ce3d23ceb3bcf1efd5f4583fa1d4dd83e73a4cde6461be46c3d9bd69deb462817b7252a774b937c35a4635bcdf2b8e1287e0a51d6cb791ae

Download Submit
memory/224-134-0x0000000000000000-mapping.dmp

Download
memory/1156-132-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1156-133-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4820-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads