2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a

General

Target

2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
Size

132KB
MD5

91e9fb690978db24b0e865e19e4d9e42
SHA1

8e47fe4ac3080f1c618ce257688aa7497eb73b7c
SHA256

2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a
SHA512

a941c083fb8411f0e0ea44b62a4d4a7282d5e012682a0e010b911cdd36153c88146aacfd88eed907e4870defe3d930e9c4b84e3a704e78c8ed397c364e6f2ba6
SSDEEP

3072:Hfby4qVctT4UfasRzof5CfUFs2OaDSGc5Nbukk5B9:Hfbz1JfaszKofsFOaTc5NKNt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
988	taskhost.exe
956	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe"	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 828 set thread context of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 988 set thread context of 956	988	taskhost.exe	30

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 828 wrote to memory of 1972	828	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	28
PID 1972 wrote to memory of 988	1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	29
PID 1972 wrote to memory of 988	1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	29
PID 1972 wrote to memory of 988	1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	29
PID 1972 wrote to memory of 988	1972	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	29
PID 988 wrote to memory of 956	988	taskhost.exe	30
PID 988 wrote to memory of 956	988	taskhost.exe	30
PID 988 wrote to memory of 956	988	taskhost.exe	30
PID 988 wrote to memory of 956	988	taskhost.exe	30
PID 988 wrote to memory of 956	988	taskhost.exe	30
PID 988 wrote to memory of 956	988	taskhost.exe	30

C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
"C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
  C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Roaming\taskhost.exe
    C:\Users\Admin\AppData\Roaming\taskhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Users\Admin\AppData\Roaming\taskhost.exe
      C:\Users\Admin\AppData\Roaming\taskhost.exe
      4⤵
      Executes dropped EXE
      PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
memory/956-75-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1972-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1972-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1972-59-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1972-74-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing