93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

General

Target

93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
Size

51KB
MD5

83ac4fd06cf50d1a9f28a5c8a0ae59c0
SHA1

0671385798daf15a238325225df13d44ac1ac03c
SHA256

93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
SHA512

acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee
SSDEEP

1536:UF+qxQcJxJljitFbOlFu2a+PpcVioN43:ObxJT9m4lFuH+ci

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3016	servet.exe
1808	servet.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\servet.exe	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File opened for modification	C:\Windows\SysWOW64\servet.exe	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File created	C:\Windows\SysWOW64\Deledomn.bat	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
File opened for modification	C:\Windows\SysWOW64\servet.exe	servet.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 3016 set thread context of 1808	3016	servet.exe	83

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 4644 wrote to memory of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 4644 wrote to memory of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 4644 wrote to memory of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 4644 wrote to memory of 2088	4644	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	81
PID 2088 wrote to memory of 3016	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	82
PID 2088 wrote to memory of 3016	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	82
PID 2088 wrote to memory of 3016	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	82
PID 3016 wrote to memory of 1808	3016	servet.exe	83
PID 3016 wrote to memory of 1808	3016	servet.exe	83
PID 3016 wrote to memory of 1808	3016	servet.exe	83
PID 3016 wrote to memory of 1808	3016	servet.exe	83
PID 3016 wrote to memory of 1808	3016	servet.exe	83
PID 2088 wrote to memory of 4708	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	85
PID 2088 wrote to memory of 4708	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	85
PID 2088 wrote to memory of 4708	2088	93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe	85

C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
"C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
  C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\servet.exe
    C:\Windows\system32\servet.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\SysWOW64\servet.exe
      C:\Windows\SysWOW64\servet.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deledomn.bat
    3⤵
    PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deledomn.bat

Filesize
248B

MD5
3b2f3aa7050fdf00f09470c09fac254e

SHA1
a69a9aba69194d0f77beb1a2162d2a82c436ec87

SHA256
119bda802b5861b8159a33ff7e9e87591d4dbf092a3adef808369c3a26379ec6

SHA512
e81947b4c96a1bdca8a2d3e9ef56f24027d7d2d6e72ea43d02a5e53a2eec8eafbc5636ad772dae4ea34a309407b557e3bf9872e177ff9f200550daa1d316b1df

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
C:\Windows\SysWOW64\servet.exe

Filesize
51KB

MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0

SHA1
0671385798daf15a238325225df13d44ac1ac03c

SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82

SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee

Download Submit
memory/1808-146-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-136-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-135-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-134-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-140-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-148-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2088-133-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads