22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be

General

Target

22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
Size

658KB
MD5

601ddad314b61246283fcaacdb1f9940
SHA1

f8e47b1bbcc07bd06e47bbb409a7cefe50c8cc3a
SHA256

22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be
SHA512

98aab411fc22ed4d8db9a6ccee4e72c4cfea9a27833a6f315d7a738f66c30d15ba7bcae386581d123186305eadcc0fe28b0a99bf3ea3f4caa0240ca1e536f084
SSDEEP

12288:SaejG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2d:2jGAK19iOCr+TMoO30mYn0YaAstHxM5h

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.Net CLR\Parameters\ServiceDll = "C:\\Windows\\system32\\6c4970.dll"	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Deletes itself 1 IoCs

pid	Process
2024	cmd.exe

Loads dropped DLL 6 IoCs

pid	Process
1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
1828	svchost.exe
1768	rundll32.exe
1768	rundll32.exe
1768	rundll32.exe
1768	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\6c4970.dll	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1828 wrote to memory of 1768	1828	svchost.exe	28
PID 1932 wrote to memory of 2024	1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	29
PID 1932 wrote to memory of 2024	1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	29
PID 1932 wrote to memory of 2024	1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	29
PID 1932 wrote to memory of 2024	1932	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	29

C:\Users\Admin\AppData\Local\Temp\22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
"C:\Users\Admin\AppData\Local\Temp\22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\22B455~1.EXE" > nul
  2⤵
  - Deletes itself
  PID:2024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ".Net CLR"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\6c4970.dll, Launch
  2⤵
  - Loads dropped DLL
  PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\Windows\SysWOW64\6c4970.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
memory/1932-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing