e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b

General

Target

e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Size

197KB
MD5

49b89d70d4f4b473d45feb41c9d5de55
SHA1

18beab94bb43a71bfa39a0963b9d304ba03ae099
SHA256

e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b
SHA512

10e7695621a7e51adeec89fd362abfebad93cc7d41aab6b8953f0fc771ece5e950c6527e433778c0dbe10944c916bf18927bbdc70737d56c4ae1b5e1a2fe4288
SSDEEP

3072:wmQXBhYYzk+8Dyy3G/zR8cxB7qFXc/Sq5ljBtzYCjfxpNvEpWOvSYhH/P95CYwF7:g1Dy3gzRXWtcKq3jBNR5jvELH7VC

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\\n."	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe

Deletes itself 1 IoCs

pid	Process
1720	cmd.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
File created	C:\Windows\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\n	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\\n."	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\clsid	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
464	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Token: SeDebugPrivilege	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Token: SeDebugPrivilege	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1388	Explorer.EXE
1388	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1388	Explorer.EXE
1388	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1388	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	12
PID 1768 wrote to memory of 1388	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	12
PID 1768 wrote to memory of 464	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	2
PID 1768 wrote to memory of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27
PID 1768 wrote to memory of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27
PID 1768 wrote to memory of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27
PID 1768 wrote to memory of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27
PID 1768 wrote to memory of 1720	1768	e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe	27

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1388
- C:\Users\Admin\AppData\Local\Temp\e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe
  "C:\Users\Admin\AppData\Local\Temp\e4821c6a3d606c72fe75582f7f37487e30ee821dd6be3553e9b2845a024f867b.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@

Filesize
2KB

MD5
9a3a765c519dd3007c1cf5b074195c8b

SHA1
53a008435935ac504db5fe1df7eb48172cc7a96e

SHA256
c3b7b1a85eaab8708cb3cad8d3cfe2b88341169a11f9e60349805763479c219d

SHA512
2ad849f5641f8c6b98ffd5c13245eb2631b4f75ed3132a0c68fadc302fdee9b62d35c090d89f9403507fe13cd5e644f4a4e9b9f24ffc08530b607b1cdd911ad2

Download Submit
memory/464-74-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/464-82-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/464-81-0x00000000000F0000-0x00000000000FC000-memory.dmp

Filesize
48KB

Download
memory/464-78-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/464-70-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/1388-76-0x0000000002A70000-0x0000000002A7C000-memory.dmp

Filesize
48KB

Download
memory/1388-80-0x0000000002A70000-0x0000000002A7C000-memory.dmp

Filesize
48KB

Download
memory/1388-57-0x0000000002A90000-0x0000000002A9F000-memory.dmp

Filesize
60KB

Download
memory/1388-77-0x0000000002AA0000-0x0000000002AAF000-memory.dmp

Filesize
60KB

Download
memory/1388-86-0x000007FF50630000-0x000007FF5063A000-memory.dmp

Filesize
40KB

Download
memory/1388-61-0x0000000002A90000-0x0000000002A9F000-memory.dmp

Filesize
60KB

Download
memory/1388-85-0x000007FEF6DB0000-0x000007FEF6EF3000-memory.dmp

Filesize
1.3MB

Download
memory/1388-65-0x0000000002A90000-0x0000000002A9F000-memory.dmp

Filesize
60KB

Download
memory/1768-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1768-84-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1768-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1768-79-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1768-55-0x0000000000270000-0x00000000002A7000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing