fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Analysis

max time kernel
31s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
Size 1.3MB
Sample221003-xa6ptabba6
SHA256 fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
MD5 4f82e4b574e41883861d0c1ee170e5c0
SHA1 792de924906049b00223c8f5d0a9193fda8212b2
SHA512 112b1b49bde0ee8d8d3bc78f05fc5f550e7299925031f609da51149da63b6d8a2fb70f3a40ce412769e589b8376928d3873e7cc5e1292fe8cb3d05bda59c80dc
SSDEEP 24576:gb7AF1GS+NwZBGRsN8EFMcI6TWf3Af1Duew9GfKUgfxAgLbr2v:w7AWnN9RE8vcI6TWPQNsGyUYxAEra
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\AUckIQIo\\wMgUsIgk.exe,"	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\AUckIQIo\\wMgUsIgk.exe,"	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe

Executes dropped EXE 6 IoCs

pid	Process
456	KcMgUUsI.exe
3168	wMgUsIgk.exe
4164	kiwoMcYA.exe
640	KcMgUUsI.exe
3164	wMgUsIgk.exe
1200	kiwoMcYA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wMgUsIgk.exe = "C:\\ProgramData\\AUckIQIo\\wMgUsIgk.exe"	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KcMgUUsI.exe = "C:\\Users\\Admin\\sksQoogk\\KcMgUUsI.exe"	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe

Modifies registry key 1 TTPs 30 IoCs

Modify Registry

T1112

pid	Process
3224	reg.exe
3808	reg.exe
1584	reg.exe
544	reg.exe
2924	reg.exe
3848	reg.exe
4612	reg.exe
1540	reg.exe
1992	reg.exe
1332	reg.exe
2416	reg.exe
2932	reg.exe
4224	reg.exe
996	reg.exe
688	reg.exe
4184	reg.exe
1764	reg.exe
4212	reg.exe
3496	reg.exe
4288	reg.exe
3784	reg.exe
3828	reg.exe
4056	reg.exe
2372	reg.exe
428	reg.exe
4364	reg.exe
4136	reg.exe
820	reg.exe
2868	reg.exe
3372	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 5096	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	83
PID 2276 wrote to memory of 5096	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	83
PID 2276 wrote to memory of 5096	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	83
PID 2276 wrote to memory of 456	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	84
PID 2276 wrote to memory of 456	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	84
PID 2276 wrote to memory of 456	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	84
PID 2276 wrote to memory of 3168	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	85
PID 2276 wrote to memory of 3168	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	85
PID 2276 wrote to memory of 3168	2276	fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe	85
PID 456 wrote to memory of 640	456	KcMgUUsI.exe	87
PID 456 wrote to memory of 640	456	KcMgUUsI.exe	87
PID 456 wrote to memory of 640	456	KcMgUUsI.exe	87
PID 3168 wrote to memory of 3164	3168	wMgUsIgk.exe	88
PID 3168 wrote to memory of 3164	3168	wMgUsIgk.exe	88
PID 3168 wrote to memory of 3164	3168	wMgUsIgk.exe	88
PID 4164 wrote to memory of 1200	4164	kiwoMcYA.exe	89
PID 4164 wrote to memory of 1200	4164	kiwoMcYA.exe	89
PID 4164 wrote to memory of 1200	4164	kiwoMcYA.exe	89

C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
"C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
  NEPS
  2⤵
  PID:5096
- C:\Users\Admin\sksQoogk\KcMgUUsI.exe
  "C:\Users\Admin\sksQoogk\KcMgUUsI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\sksQoogk\KcMgUUsI.exe
    KSWY
    3⤵
    - Executes dropped EXE
    PID:640
- C:\ProgramData\AUckIQIo\wMgUsIgk.exe
  "C:\ProgramData\AUckIQIo\wMgUsIgk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\ProgramData\AUckIQIo\wMgUsIgk.exe
    UKFN
    3⤵
    - Executes dropped EXE
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
  2⤵
  PID:3200
- - C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
    C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
    3⤵
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
      NEPS
      4⤵
      PID:4956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        5⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        6⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        7⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        8⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        9⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        10⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:3224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        Modifies registry key
        
        PID:820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies registry key
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        10⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        11⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        12⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        12⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        13⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        14⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        14⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        15⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        16⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        16⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        17⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        18⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573"
        18⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
        19⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573.exe
        
        NEPS
        20⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies registry key
        
        PID:688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:4184
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        Modifies registry key
        
        PID:428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies registry key
        
        PID:1584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        Modifies registry key
        
        PID:2868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies registry key
        
        PID:3784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:2932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        Modifies registry key
        
        PID:996
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies registry key
        
        PID:1764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:2416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        Modifies registry key
        
        PID:3808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies registry key
        
        PID:4288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:2372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        Modifies registry key
        
        PID:1540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies registry key
        
        PID:3496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:4056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        Modifies registry key
        
        PID:1992
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:3372
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:4136
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:4224
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3848
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4364
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:4212
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:4612
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:2924
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3828

C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164
- C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
  SWYM
  2⤵
  - Executes dropped EXE
  PID:1200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wMgUsIgk.exe

Path C:\ProgramData\AUckIQIo\wMgUsIgk.exe
Size 1.3MB
SHA256 09885621d11e9b4b67e677c30ce754f858981b4131b93aeca7c9a6c0f5562a50
MD5 84f42733e3727ce1d692766927a512a6
SHA1 255d480dc2ee6a14ab0a22e3b8df8d41d6416fb8
SHA512 9b2b97180829133d4be9a09f0484d52fcd66f233a82457869d193b1cafb75233531ef26b5ad512ed80ae8efbda42ec95a34a4df5142bbc2577abcad7ea894c51
SSDEEP 24576:1hPWkvtAM2b7iXStNz2PlYHRmLd1Xdn3CSEyHuGjEKrFC:7vaBnx3zzR2tp3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

wMgUsIgk.exe

Path C:\ProgramData\AUckIQIo\wMgUsIgk.exe
Size 1.3MB
SHA256 09885621d11e9b4b67e677c30ce754f858981b4131b93aeca7c9a6c0f5562a50
MD5 84f42733e3727ce1d692766927a512a6
SHA1 255d480dc2ee6a14ab0a22e3b8df8d41d6416fb8
SHA512 9b2b97180829133d4be9a09f0484d52fcd66f233a82457869d193b1cafb75233531ef26b5ad512ed80ae8efbda42ec95a34a4df5142bbc2577abcad7ea894c51
SSDEEP 24576:1hPWkvtAM2b7iXStNz2PlYHRmLd1Xdn3CSEyHuGjEKrFC:7vaBnx3zzR2tp3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

wMgUsIgk.exe

Path C:\ProgramData\AUckIQIo\wMgUsIgk.exe
Size 1.3MB
SHA256 09885621d11e9b4b67e677c30ce754f858981b4131b93aeca7c9a6c0f5562a50
MD5 84f42733e3727ce1d692766927a512a6
SHA1 255d480dc2ee6a14ab0a22e3b8df8d41d6416fb8
SHA512 9b2b97180829133d4be9a09f0484d52fcd66f233a82457869d193b1cafb75233531ef26b5ad512ed80ae8efbda42ec95a34a4df5142bbc2577abcad7ea894c51
SSDEEP 24576:1hPWkvtAM2b7iXStNz2PlYHRmLd1Xdn3CSEyHuGjEKrFC:7vaBnx3zzR2tp3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

wMgUsIgkUKFN

Path C:\ProgramData\AUckIQIo\wMgUsIgkUKFN
Size 4B
SHA256 7273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
MD5 9134669f44c1af0532f613b7508283c4
SHA1 1c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA512 ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
MD5 SHA1 SHA512

Submit Download

kiwoMcYA.exe

Path C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
Size 1.3MB
SHA256 16b29ddb035496d90398f45d3ebbf02510d9544a2dd2905983db0a0e4fcaf0bd
MD5 f1f46b7625259436fa242abd720f54f9
SHA1 379eeedd0816b141785ff2760d8405208cd750ef
SHA512 d2b84d23e3eb6742dabd0a0ba1b841cd8652510ed25e07cbf7ee1e40ee18cacbc21b52c49a95c59ee87c0f05f0ced752e93bb9fb54c5addfbed521d0e71fa972
SSDEEP 24576:ctiFNB18z8weRcP3mk/ag/cEV5M1mmM+ENqw6AOen3f+ztSDye:YiFSz8weRSag/cEV5MFuOe3fItSDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

kiwoMcYA.exe

Path C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
Size 1.3MB
SHA256 16b29ddb035496d90398f45d3ebbf02510d9544a2dd2905983db0a0e4fcaf0bd
MD5 f1f46b7625259436fa242abd720f54f9
SHA1 379eeedd0816b141785ff2760d8405208cd750ef
SHA512 d2b84d23e3eb6742dabd0a0ba1b841cd8652510ed25e07cbf7ee1e40ee18cacbc21b52c49a95c59ee87c0f05f0ced752e93bb9fb54c5addfbed521d0e71fa972
SSDEEP 24576:ctiFNB18z8weRcP3mk/ag/cEV5M1mmM+ENqw6AOen3f+ztSDye:YiFSz8weRSag/cEV5MFuOe3fItSDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

kiwoMcYA.exe

Path C:\ProgramData\qiMUUcAs\kiwoMcYA.exe
Size 1.3MB
SHA256 16b29ddb035496d90398f45d3ebbf02510d9544a2dd2905983db0a0e4fcaf0bd
MD5 f1f46b7625259436fa242abd720f54f9
SHA1 379eeedd0816b141785ff2760d8405208cd750ef
SHA512 d2b84d23e3eb6742dabd0a0ba1b841cd8652510ed25e07cbf7ee1e40ee18cacbc21b52c49a95c59ee87c0f05f0ced752e93bb9fb54c5addfbed521d0e71fa972
SSDEEP 24576:ctiFNB18z8weRcP3mk/ag/cEV5M1mmM+ENqw6AOen3f+ztSDye:YiFSz8weRSag/cEV5MFuOe3fItSDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

kiwoMcYASWYM

Path C:\ProgramData\qiMUUcAs\kiwoMcYASWYM
Size 4B
SHA256 7273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
MD5 9134669f44c1af0532f613b7508283c4
SHA1 1c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA512 ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
MD5 SHA1 SHA512

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573

Path C:\Users\Admin\AppData\Local\Temp\fbee74bbc362487093acb5be71e06c05f64ae48cdc20e611b0098f0ff3535573
Size 8KB
SHA256 55ceef05d4505d20f7230c1f01db5509f004ae0f402bc977dc89c9b3c73581cc
MD5 8b6f69f7f16e2d3e3d856da1a1c12c8a
SHA1 0797f1ad9bd376773ac181448306c6b5331b550d
SHA512 5927095fe2cec1255b1dafc8697a6c0b7d1b3fadccd42698b70d9f895f46b2f29ad315318aedc91edc35b9ba83b2d4d12cafbef7e24a01a3eca12db4e1763f96
SSDEEP 192:/vx8niJZwzVvrf/X9EFRwtzb2qdBhNdTpa8FuX/8:eniJZ+8wX3paUR
MD5 SHA1 SHA512 SSDEEP

Submit Download