6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad

General

Target

6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
Size

124KB
MD5

0cb31cf501e1d0cfe6e0a26df5525850
SHA1

75d6092570e384c7a0578f0bde286362eea32844
SHA256

6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad
SHA512

d28934edd537f6ba4f562806f1a40eb90d754c2caa4974d772e8b4c79a728382133c3d5b13bdaf5f7401e4ad8b1f59faaf7589821d3b6e7b065a82bc1375c82a
SSDEEP

1536:vLBYbzcsgkNn4jnstTfIGsXbJyBnZuZ27ogIlt7TeNJOSA5mEY7X05uHaW34k5RZ:zLjnstTf9ZuZ2MgGwQ/2auHaFq4UvJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
644	jo3rgz87.exe
1124	jo3rgz87.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\q92yb = "C:\\Users\\Admin\\AppData\\Roaming\\jo3rgz87.exe"	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 644 set thread context of 1124	644	jo3rgz87.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2032 wrote to memory of 2016	2032	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	27
PID 2016 wrote to memory of 644	2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	28
PID 2016 wrote to memory of 644	2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	28
PID 2016 wrote to memory of 644	2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	28
PID 2016 wrote to memory of 644	2016	6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe	28
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29
PID 644 wrote to memory of 1124	644	jo3rgz87.exe	29

C:\Users\Admin\AppData\Local\Temp\6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
"C:\Users\Admin\AppData\Local\Temp\6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
  C:\Users\Admin\AppData\Local\Temp\6c9d80521de98292ff5c53d7ae6ce0bb29d8814182a6c8adc8595b98e8833aad.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
    C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
      C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
      4⤵
      Executes dropped EXE
      PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
124KB

MD5
968d7dadd377858705d174706557b2f5

SHA1
2930ed54a5f7b737eeb4edab1fc882c7f6ff2958

SHA256
045fdda3ed3867d5c4d5dd893e583c657e5c944c0b37e84c3663d6745674a042

SHA512
e58909ea9189c7729602d3df95bf49e7f76358775b6ae71aad07c36e78870f8826d19441b597767e4a17c59a798cfa36e9efa2b6585785a700c327da827a0e8b

Download Submit
C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
124KB

MD5
968d7dadd377858705d174706557b2f5

SHA1
2930ed54a5f7b737eeb4edab1fc882c7f6ff2958

SHA256
045fdda3ed3867d5c4d5dd893e583c657e5c944c0b37e84c3663d6745674a042

SHA512
e58909ea9189c7729602d3df95bf49e7f76358775b6ae71aad07c36e78870f8826d19441b597767e4a17c59a798cfa36e9efa2b6585785a700c327da827a0e8b

Download Submit
C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
124KB

MD5
968d7dadd377858705d174706557b2f5

SHA1
2930ed54a5f7b737eeb4edab1fc882c7f6ff2958

SHA256
045fdda3ed3867d5c4d5dd893e583c657e5c944c0b37e84c3663d6745674a042

SHA512
e58909ea9189c7729602d3df95bf49e7f76358775b6ae71aad07c36e78870f8826d19441b597767e4a17c59a798cfa36e9efa2b6585785a700c327da827a0e8b

Download Submit
\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
124KB

MD5
968d7dadd377858705d174706557b2f5

SHA1
2930ed54a5f7b737eeb4edab1fc882c7f6ff2958

SHA256
045fdda3ed3867d5c4d5dd893e583c657e5c944c0b37e84c3663d6745674a042

SHA512
e58909ea9189c7729602d3df95bf49e7f76358775b6ae71aad07c36e78870f8826d19441b597767e4a17c59a798cfa36e9efa2b6585785a700c327da827a0e8b

Download Submit
\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
124KB

MD5
968d7dadd377858705d174706557b2f5

SHA1
2930ed54a5f7b737eeb4edab1fc882c7f6ff2958

SHA256
045fdda3ed3867d5c4d5dd893e583c657e5c944c0b37e84c3663d6745674a042

SHA512
e58909ea9189c7729602d3df95bf49e7f76358775b6ae71aad07c36e78870f8826d19441b597767e4a17c59a798cfa36e9efa2b6585785a700c327da827a0e8b

Download Submit
memory/1124-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1124-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1124-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-59-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing