97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

General

Target

97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Size

216KB
MD5

636ad7e91d83a037ccd874efe80bf3dd
SHA1

1f6cc3252439220674e2552a5e44b39029772dcb
SHA256

97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b
SHA512

25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b
SSDEEP

3072:Kn9XSwbPXRahcCXnAsdGHdd7zCtAfDjwvc+JkdjX:Kn95LIA8AJzCtA0vc+Jkdj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2964	sesnaesttoo.exe
4948	sesnaesttoo.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v7.7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaesttoo.exe"	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v7.7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaesttoo.exe"	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 2964 set thread context of 4948	2964	sesnaesttoo.exe	80

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
2964	sesnaesttoo.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 3408 wrote to memory of 924	3408	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	78
PID 924 wrote to memory of 2964	924	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	79
PID 924 wrote to memory of 2964	924	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	79
PID 924 wrote to memory of 2964	924	97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe	79
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80
PID 2964 wrote to memory of 4948	2964	sesnaesttoo.exe	80

C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
"C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe
  "C:\Users\Admin\AppData\Local\Temp\97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe
    "C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe
      "C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe"
      4⤵
      Executes dropped EXE
      PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sesnaesttoo.exe

Filesize
216KB

MD5
636ad7e91d83a037ccd874efe80bf3dd

SHA1
1f6cc3252439220674e2552a5e44b39029772dcb

SHA256
97258d62c0b699e97daf3f7c0e083b4ee05ed1cbecbbcc50a1def5a27f97a73b

SHA512
25a43a380b5c8baaac685bb73f7c81f62d19f064e8eb084a27150656e213988d1d99ba42d8d547bc4ec0202323061d4f90bcac292e8516c526285f6fdea7d74b

Download Submit
memory/924-139-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/924-140-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/924-146-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/924-136-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2964-147-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2964-152-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3408-138-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3408-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4948-153-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4948-154-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4948-155-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing