e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe
Size

321KB
MD5

0e8ff9932f8f00edf322ea26d8d94f52
SHA1

51b7770e12872aa9f3441637ff6dbb3b32bd0166
SHA256

e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4
SHA512

541807b9f45bc67f1eac79bf04375c04b0ee4fbf5b619914bc563ce21c6590ae9c7a96a3602a6d6171e3c3c9bc2521ff37aa539042e79ee35d1a776f8bc3d854
SSDEEP

6144:U/38eZNr4x2EwrIFAwKpbLNjZTXDs+DY+6QrTakwTg9RPtT:U/hZNkwIFAwuBjZ7maaZg9R

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5048	seih.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	seih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{4CDAB5F0-556D-BCA0-9C47-614551B27B47} = "C:\\Users\\Admin\\AppData\\Roaming\\Vylyy\\seih.exe"	seih.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 4852	5060	e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe	82

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe
5048	seih.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5048	5060	e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe	81
PID 5060 wrote to memory of 5048	5060	e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe	81
PID 5060 wrote to memory of 5048	5060	e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe	81
PID 5048 wrote to memory of 2296	5048	seih.exe	39
PID 5048 wrote to memory of 2296	5048	seih.exe	39
PID 5048 wrote to memory of 2296	5048	seih.exe	39
PID 5048 wrote to memory of 2296	5048	seih.exe	39
PID 5048 wrote to memory of 2296	5048	seih.exe	39
PID 5048 wrote to memory of 2308	5048	seih.exe	41
PID 5048 wrote to memory of 2308	5048	seih.exe	41
PID 5048 wrote to memory of 2308	5048	seih.exe	41
PID 5048 wrote to memory of 2308	5048	seih.exe	41
PID 5048 wrote to memory of 2308	5048	seih.exe	41
PID 5048 wrote to memory of 2472	5048	seih.exe	76
PID 5048 wrote to memory of 2472	5048	seih.exe	76
PID 5048 wrote to memory of 2472	5048	seih.exe	76
PID 5048 wrote to memory of 2472	5048	seih.exe	76
PID 5048 wrote to memory of 2472	5048	seih.exe	76
PID 5048 wrote to memory of 2376	5048	seih.exe	48
PID 5048 wrote to memory of 2376	5048	seih.exe	48
PID 5048 wrote to memory of 2376	5048	seih.exe	48
PID 5048 wrote to memory of 2376	5048	seih.exe	48
PID 5048 wrote to memory of 2376	5048	seih.exe	48
PID 5048 wrote to memory of 1352	5048	seih.exe	73
PID 5048 wrote to memory of 1352	5048	seih.exe	73
PID 5048 wrote to memory of 1352	5048	seih.exe	73
PID 5048 wrote to memory of 1352	5048	seih.exe	73
PID 5048 wrote to memory of 1352	5048	seih.exe	73
PID 5048 wrote to memory of 3252	5048	seih.exe	72
PID 5048 wrote to memory of 3252	5048	seih.exe	72
PID 5048 wrote to memory of 3252	5048	seih.exe	72
PID 5048 wrote to memory of 3252	5048	seih.exe	72
PID 5048 wrote to memory of 3252	5048	seih.exe	72
PID 5048 wrote to memory of 3404	5048	seih.exe	70
PID 5048 wrote to memory of 3404	5048	seih.exe	70
PID 5048 wrote to memory of 3404	5048	seih.exe	70
PID 5048 wrote to memory of 3404	5048	seih.exe	70
PID 5048 wrote to memory of 3404	5048	seih.exe	70
PID 5048 wrote to memory of 3492	5048	seih.exe	49
PID 5048 wrote to memory of 3492	5048	seih.exe	49
PID 5048 wrote to memory of 3492	5048	seih.exe	49
PID 5048 wrote to memory of 3492	5048	seih.exe	49
PID 5048 wrote to memory of 3492	5048	seih.exe	49
PID 5048 wrote to memory of 3576	5048	seih.exe	69
PID 5048 wrote to memory of 3576	5048	seih.exe	69
PID 5048 wrote to memory of 3576	5048	seih.exe	69
PID 5048 wrote to memory of 3576	5048	seih.exe	69
PID 5048 wrote to memory of 3576	5048	seih.exe	69
PID 5048 wrote to memory of 3828	5048	seih.exe	68
PID 5048 wrote to memory of 3828	5048	seih.exe	68
PID 5048 wrote to memory of 3828	5048	seih.exe	68
PID 5048 wrote to memory of 3828	5048	seih.exe	68
PID 5048 wrote to memory of 3828	5048	seih.exe	68
PID 5048 wrote to memory of 4872	5048	seih.exe	67
PID 5048 wrote to memory of 4872	5048	seih.exe	67
PID 5048 wrote to memory of 4872	5048	seih.exe	67
PID 5048 wrote to memory of 4872	5048	seih.exe	67
PID 5048 wrote to memory of 4872	5048	seih.exe	67
PID 5048 wrote to memory of 5060	5048	seih.exe	80
PID 5048 wrote to memory of 5060	5048	seih.exe	80
PID 5048 wrote to memory of 5060	5048	seih.exe	80
PID 5048 wrote to memory of 5060	5048	seih.exe	80
PID 5048 wrote to memory of 5060	5048	seih.exe	80
PID 5060 wrote to memory of 4852	5060	e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe	82

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2308

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe
  "C:\Users\Admin\AppData\Local\Temp\e94cd09d1977559579b795b7a37119ef95f10d75354868747c314676c23e61f4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Roaming\Vylyy\seih.exe
    "C:\Users\Admin\AppData\Roaming\Vylyy\seih.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6515b929.bat"
    3⤵
    PID:4852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3576

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1352

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6515b929.bat

Filesize
307B

MD5
94d3e970958a8162371e80cbd4372621

SHA1
1ebc0b0bb5b3ac5a2594c19e66ad1cc8e87aded9

SHA256
4b2cc1348e2c0f42013cbd4fe3578c003f913c130069da298a4162ef3792eb4a

SHA512
1101ce4e4e8d71d1542e1e3073922599bc113883f43c959747b8e5f89927de68d999db6577ceb5a5e924a6c2c8656b8aed64b91238a108cb845ff4e0f8ef94fb

Download Submit
C:\Users\Admin\AppData\Roaming\Vylyy\seih.exe

Filesize
321KB

MD5
55f620e01786395b4bafa09df585185b

SHA1
a2928f593bf0882ad2a8676a16a5cc65ae630040

SHA256
320500511b04a628146fa851d4089e95e0edb7833328270b76b45e04ab45dc7e

SHA512
7c77c4c5aa0055ecafc7930c7066c6d32bfa69d6f39f601c8026c42ace64f2e331f2445c3f3a5546645734169a9cce8ff181528f16d609bfcd58d50e179f155a

Download Submit
C:\Users\Admin\AppData\Roaming\Vylyy\seih.exe

Filesize
321KB

MD5
55f620e01786395b4bafa09df585185b

SHA1
a2928f593bf0882ad2a8676a16a5cc65ae630040

SHA256
320500511b04a628146fa851d4089e95e0edb7833328270b76b45e04ab45dc7e

SHA512
7c77c4c5aa0055ecafc7930c7066c6d32bfa69d6f39f601c8026c42ace64f2e331f2445c3f3a5546645734169a9cce8ff181528f16d609bfcd58d50e179f155a

Download Submit
memory/4852-161-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-160-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-158-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-163-0x0000000000A60000-0x0000000000AA7000-memory.dmp

Filesize
284KB

Download
memory/4852-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-157-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-159-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-156-0x0000000000A60000-0x0000000000AA7000-memory.dmp

Filesize
284KB

Download
memory/4852-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4852-150-0x0000000000A60000-0x0000000000AA7000-memory.dmp

Filesize
284KB

Download
memory/5048-140-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5048-142-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5048-165-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5048-164-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5048-141-0x0000000000570000-0x00000000005C0000-memory.dmp

Filesize
320KB

Download
memory/5060-151-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5060-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5060-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5060-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5060-152-0x0000000002080000-0x00000000020D0000-memory.dmp

Filesize
320KB

Download
memory/5060-147-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5060-132-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5060-154-0x00000000026A0000-0x00000000026E7000-memory.dmp

Filesize
284KB

Download
memory/5060-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5060-136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5060-134-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5060-133-0x0000000002080000-0x00000000020D0000-memory.dmp

Filesize
320KB

Download
memory/5060-146-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5060-148-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download