93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

General

Target

93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
Size

51KB
MD5

83ac4fd06cf50d1a9f28a5c8a0ae59c0
SHA1

0671385798daf15a238325225df13d44ac1ac03c
SHA256

93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
SHA512

acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee
SSDEEP

1536:UF+qxQcJxJljitFbOlFu2a+PpcVioN43:ObxJT9m4lFuH+ci

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
848	servet.exe
1536	servet.exe

Deletes itself 1 IoCs

pid	Process
1380	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\servet.exe	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File opened for modification	C:\Windows\SysWOW64\servet.exe	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File created	C:\Windows\SysWOW64\Deledomn.bat	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File opened for modification	C:\Windows\SysWOW64\servet.exe	servet.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1004 set thread context of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 848 set thread context of 1536	848	servet.exe	30

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1004 wrote to memory of 1212	1004	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	28
PID 1212 wrote to memory of 848	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	29
PID 1212 wrote to memory of 848	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	29
PID 1212 wrote to memory of 848	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	29
PID 1212 wrote to memory of 848	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	29
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 848 wrote to memory of 1536	848	servet.exe	30
PID 1212 wrote to memory of 1380	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	31
PID 1212 wrote to memory of 1380	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	31
PID 1212 wrote to memory of 1380	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	31
PID 1212 wrote to memory of 1380	1212	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	31

C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
"C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
  C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\servet.exe
    C:\Windows\system32\servet.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\servet.exe
      C:\Windows\SysWOW64\servet.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\Deledomn.bat
    3⤵
    - Deletes itself
    PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deledomn.bat

Filesize
248B

MD5
3b2f3aa7050fdf00f09470c09fac254e

SHA1
a69a9aba69194d0f77beb1a2162d2a82c436ec87

SHA256
119bda802b5861b8159a33ff7e9e87591d4dbf092a3adef808369c3a26379ec6

SHA512
e81947b4c96a1bdca8a2d3e9ef56f24027d7d2d6e72ea43d02a5e53a2eec8eafbc5636ad772dae4ea34a309407b557e3bf9872e177ff9f200550daa1d316b1df

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
memory/1212-58-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1212-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1212-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1212-71-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1212-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1536-70-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing