2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a

General

Target

2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
Size

132KB
MD5

91e9fb690978db24b0e865e19e4d9e42
SHA1

8e47fe4ac3080f1c618ce257688aa7497eb73b7c
SHA256

2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a
SHA512

a941c083fb8411f0e0ea44b62a4d4a7282d5e012682a0e010b911cdd36153c88146aacfd88eed907e4870defe3d930e9c4b84e3a704e78c8ed397c364e6f2ba6
SSDEEP

3072:Hfby4qVctT4UfasRzof5CfUFs2OaDSGc5Nbukk5B9:Hfbz1JfaszKofsFOaTc5NKNt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3412	taskhost.exe
1296	taskhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe"	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 3412 set thread context of 1296	3412	taskhost.exe	87

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3192	4692	WerFault.exe	80
1384	3412	WerFault.exe	85

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 4692 wrote to memory of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 4692 wrote to memory of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 4692 wrote to memory of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 4692 wrote to memory of 5000	4692	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	82
PID 5000 wrote to memory of 3412	5000	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	85
PID 5000 wrote to memory of 3412	5000	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	85
PID 5000 wrote to memory of 3412	5000	2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe	85
PID 3412 wrote to memory of 1296	3412	taskhost.exe	87
PID 3412 wrote to memory of 1296	3412	taskhost.exe	87
PID 3412 wrote to memory of 1296	3412	taskhost.exe	87
PID 3412 wrote to memory of 1296	3412	taskhost.exe	87
PID 3412 wrote to memory of 1296	3412	taskhost.exe	87

C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
"C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
  C:\Users\Admin\AppData\Local\Temp\2acdece67c4286c33f5ea4345d365a476a37a457d6f0396f9c2be6a4f8abe57a.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Roaming\taskhost.exe
    C:\Users\Admin\AppData\Roaming\taskhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Users\Admin\AppData\Roaming\taskhost.exe
      C:\Users\Admin\AppData\Roaming\taskhost.exe
      4⤵
      Executes dropped EXE
      PID:1296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 292
      4⤵
      Program crash
      PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 292
  2⤵
  - Program crash
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4692 -ip 4692
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3412 -ip 3412
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
C:\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
6bf6fc77407ec1172a77b7ca28fc0183

SHA1
439f27309a77e19cb75e38bbc9f8f90483fb1e74

SHA256
75f149b2dc1f4f5acb59be6bd6037ca0fe16f08c02feecee80c71bfcf57dc222

SHA512
11738ece5e9288fc243cbbdd89177da451bd7f4e94ae6ac10a54d7abf0f18baafe8daa394cf9316f6727bd347d4e53a1be59c88a3d3a19cb1b6921d773857afa

Download Submit
memory/1296-143-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1296-144-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1296-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5000-136-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5000-135-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5000-134-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5000-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing