d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f

General

Target

d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe
Size

172KB
MD5

6ad2999dfefa95ef556f77b6cdfd00d0
SHA1

df2ce712d188fb8a94113f692637b172741dfb6e
SHA256

d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f
SHA512

114eee6055ccf859893b1c7807f90ce01f78ba5aa5710f15feee64f84f045864600249c5d997c7b2d0830d48c8a5905319db301cc684f25be9634f40dcd29dc6
SSDEEP

3072:w+/eO6r12VjjqUM5Vn5L8NJ5f+8ciuR4S7Tb2QSh7H:w+28VjqV5+GfPU7H

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dskchk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe"	regedit.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26

Runs regedit.exe 1 IoCs

pid	Process
1944	regedit.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1160 wrote to memory of 1892	1160	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	26
PID 1892 wrote to memory of 1944	1892	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	27
PID 1892 wrote to memory of 1944	1892	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	27
PID 1892 wrote to memory of 1944	1892	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	27
PID 1892 wrote to memory of 1944	1892	d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe	27

C:\Users\Admin\AppData\Local\Temp\d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe
"C:\Users\Admin\AppData\Local\Temp\d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe
  "C:\Users\Admin\AppData\Local\Temp\d5b70e5375ac377b0983b709ec4bd6504b4dca45f70e39ceec47fb9175ac676f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Users\Admin\AppData\Local\Temp\rtf8CF5.tmp
    3⤵
    - Adds Run key to start application
    - Runs regedit.exe
    PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rtf8CF5.tmp

Filesize
199B

MD5
bc3004992fadfcf16a6bc4e90dff442b

SHA1
057b9b6ac2903765c28e0e51ec4b07597ca46bac

SHA256
a1508e893a0e7eb2f87a4c4176c8a99e5f906167105d67a264a62310a2c84d61

SHA512
053ce643998755da53093c8bddaea48530ab946c0515f205eb09a9a1f64997f6206b6ef796668f0d796cf4fca28eef3a2e26c3ada316f536c0c1f94db2971a6f

Download Submit
memory/1892-65-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-59-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-54-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-57-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-68-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-69-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-73-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1892-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1944-71-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing