97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

General

Target

97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Size

216KB
MD5

636ad7e91d83a037ccd874efe80bf3dd
SHA1

1f6cc3252439220674e2552a5e44b39029772dcb
SHA256

97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b
SHA512

25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b
SSDEEP

3072:Kn9XSwbPXRahcCXnAsdGHdd7zCtAfDjwvc+JkdjX:Kn95LIA8AJzCtA0vc+Jkdj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1444	sesnaesttoo.exe
1220	sesnaesttoo.exe

Loads dropped DLL 3 IoCs

pid	Process
1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
1444	sesnaesttoo.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v7.7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaesttoo.exe"	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v7.7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaesttoo.exe"	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1444 set thread context of 1220	1444	sesnaesttoo.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
1444	sesnaesttoo.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1044 wrote to memory of 1712	1044	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	27
PID 1712 wrote to memory of 1444	1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	28
PID 1712 wrote to memory of 1444	1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	28
PID 1712 wrote to memory of 1444	1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	28
PID 1712 wrote to memory of 1444	1712	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	28
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29
PID 1444 wrote to memory of 1220	1444	sesnaesttoo.exe	29

C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
"C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
  "C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe
    "C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe
      "C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe"
      4⤵
      Executes dropped EXE
      PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
memory/1044-60-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1220-79-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1220-80-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1444-77-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1712-62-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1712-61-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1712-59-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1712-78-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing