86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06

General

Target

86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe
Size

7.1MB
MD5

32bdaa7e33fa1d6120549cfac054d06b
SHA1

f579172541393ac9f91cf953651e669984d34698
SHA256

86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06
SHA512

1a3fad8c0fd6bebd0f2a7c29fb5e1f01042a736a37dd50cda0e428d5d9b7d6074fa903186b6064d55fb4df71764aac7402c2f3ab46df979e111ea66050af0836
SSDEEP

24576:7mcnH5tkoxFAiKfOLvsyQStlCk6bTTNLp1+Qa0h:7RnHA8Aqag4k8pF

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	HSLx264_32HHH.bin
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	HSLx264_32HHH.bin

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5060	HSLx264_32HHH.bin
4200	HSLx264_32HHH.bin

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	HSLx264_32HHH.bin

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	HSLx264_32HHH.bin
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSVCModuleInstaller = "\"C:\\ProgramData\\ExMultimediaStorage\\reloadbitex.exe\""	HSLx264_32HHH.bin

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1248	sc.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4500	ping.exe
564	ping.exe
1640	ping.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4500	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	84
PID 2704 wrote to memory of 4500	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	84
PID 2704 wrote to memory of 4500	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	84
PID 2704 wrote to memory of 5060	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	93
PID 2704 wrote to memory of 5060	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	93
PID 2704 wrote to memory of 5060	2704	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	93
PID 5060 wrote to memory of 564	5060	HSLx264_32HHH.bin	94
PID 5060 wrote to memory of 564	5060	HSLx264_32HHH.bin	94
PID 5060 wrote to memory of 564	5060	HSLx264_32HHH.bin	94
PID 5060 wrote to memory of 2940	5060	HSLx264_32HHH.bin	106
PID 5060 wrote to memory of 2940	5060	HSLx264_32HHH.bin	106
PID 5060 wrote to memory of 2940	5060	HSLx264_32HHH.bin	106
PID 5060 wrote to memory of 1248	5060	HSLx264_32HHH.bin	108
PID 5060 wrote to memory of 1248	5060	HSLx264_32HHH.bin	108
PID 5060 wrote to memory of 1248	5060	HSLx264_32HHH.bin	108
PID 5060 wrote to memory of 2344	5060	HSLx264_32HHH.bin	110
PID 5060 wrote to memory of 2344	5060	HSLx264_32HHH.bin	110
PID 5060 wrote to memory of 2344	5060	HSLx264_32HHH.bin	110
PID 5060 wrote to memory of 4200	5060	HSLx264_32HHH.bin	112
PID 5060 wrote to memory of 4200	5060	HSLx264_32HHH.bin	112
PID 5060 wrote to memory of 4200	5060	HSLx264_32HHH.bin	112
PID 4200 wrote to memory of 1640	4200	HSLx264_32HHH.bin	113
PID 4200 wrote to memory of 1640	4200	HSLx264_32HHH.bin	113
PID 4200 wrote to memory of 1640	4200	HSLx264_32HHH.bin	113

C:\Users\Admin\AppData\Local\Temp\86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe
"C:\Users\Admin\AppData\Local\Temp\86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\ping.exe
  ping 4.4.8.8
  2⤵
  - Runs ping.exe
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\HSLx264_32HHH.bin
  "C:\Users\Admin\AppData\Local\Temp\\HSLx264_32HHH.bin"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\ping.exe
    ping -n 20 12.232.4.32
    3⤵
    - Runs ping.exe
    PID:564
- - C:\Windows\SysWOW64\net1.exe
    net1 stop windefend
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config windefend depend= RpcSs-TOGGLE
    3⤵
    - Launches sc.exe
    PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C copy "C:\Users\Admin\AppData\Local\Temp\\HSLx264_32HHH.bin" "C:\ProgramData\ExMultimediaStorage\min_id_resolver.exe"
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\HSLx264_32HHH.bin
    C:\Users\Admin\AppData\Local\Temp\\HSLx264_32HHH.bin emulate -d -lp
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\SysWOW64\ping.exe
      ping -n 20 12.232.4.32
      4⤵
      Runs ping.exe
      PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HSLx264_32HHH.bin

Filesize
381KB

MD5
62dfaf43c410edcd4233f6249e9ea801

SHA1
411352e34cf579d63463d2ccfdc485ca9acaaede

SHA256
b0ae66952cfe592df34f2b6d9e50bccd14d05f56f93d188287b4c2069352fca8

SHA512
bc33b2056bbd1866fba74c26fe307de1550dd86aaaa42e255f560303cad980ba79a6f0fbac1fad167323a086e80124686711f2db7cd9e328c659db0bc4b93317

Download Submit
C:\Users\Admin\AppData\Local\Temp\HSLx264_32HHH.bin

Filesize
381KB

MD5
62dfaf43c410edcd4233f6249e9ea801

SHA1
411352e34cf579d63463d2ccfdc485ca9acaaede

SHA256
b0ae66952cfe592df34f2b6d9e50bccd14d05f56f93d188287b4c2069352fca8

SHA512
bc33b2056bbd1866fba74c26fe307de1550dd86aaaa42e255f560303cad980ba79a6f0fbac1fad167323a086e80124686711f2db7cd9e328c659db0bc4b93317

Download Submit
C:\Users\Admin\AppData\Local\Temp\HSLx264_32HHH.bin

Filesize
381KB

MD5
62dfaf43c410edcd4233f6249e9ea801

SHA1
411352e34cf579d63463d2ccfdc485ca9acaaede

SHA256
b0ae66952cfe592df34f2b6d9e50bccd14d05f56f93d188287b4c2069352fca8

SHA512
bc33b2056bbd1866fba74c26fe307de1550dd86aaaa42e255f560303cad980ba79a6f0fbac1fad167323a086e80124686711f2db7cd9e328c659db0bc4b93317

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads