1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65

General

Target

1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
Size

267KB
MD5

0d2a33308a19ebc24ddaef450cc65268
SHA1

7ba0923b3a44af654025fba884c5df0fc0501453
SHA256

1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65
SHA512

8382920d4502a520ab53d4cebbc5a5233461648eabc2b8f07f439b2c287f5ecd6ba1640666940034cedfbb7c77fb48c8c904f95939e3fec47de6e6a2321963c9
SSDEEP

6144:KxZaok06CN5fmVQH0heA8nXiUSz7ArwAVpN2u6:Ke015+Vq+8XrqMbVpI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1352	Xnsrzlo2lsm.exe
468	Xnsrzlo2lsm.exe

Deletes itself 1 IoCs

pid	Process
468	Xnsrzlo2lsm.exe

Loads dropped DLL 4 IoCs

pid	Process
1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
468	Xnsrzlo2lsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\n7WLxFjSEyhq = "C:\\ProgramData\\jBPTTAROWzGYLE\\Xnsrzlo2lsm.exe"	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1352 set thread context of 468	1352	Xnsrzlo2lsm.exe	29
PID 468 set thread context of 1916	468	Xnsrzlo2lsm.exe	30

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1460 wrote to memory of 1532	1460	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	27
PID 1532 wrote to memory of 1352	1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	28
PID 1532 wrote to memory of 1352	1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	28
PID 1532 wrote to memory of 1352	1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	28
PID 1532 wrote to memory of 1352	1532	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	28
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 1352 wrote to memory of 468	1352	Xnsrzlo2lsm.exe	29
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30
PID 468 wrote to memory of 1916	468	Xnsrzlo2lsm.exe	30

C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
"C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
  "C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe
    "C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe
      "C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe" /i:468
        5⤵
        
        PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
C:\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
\ProgramData\jBPTTAROWzGYLE\Xnsrzlo2lsm.exe

Filesize
267KB

MD5
0d2a33308a19ebc24ddaef450cc65268

SHA1
7ba0923b3a44af654025fba884c5df0fc0501453

SHA256
1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65

SHA512
8382920d4502a520ab53d4cebbc5a5233461648eabc2b8f07f439b2c287f5ecd6ba1640666940034cedfbb7c77fb48c8c904f95939e3fec47de6e6a2321963c9

Download Submit
\Users\Admin\AppData\Local\Temp\utcU9aNGL.exe

Filesize
267KB

MD5
bee7353d060b3bd3d7f9bbfb3e6b0c0d

SHA1
6207ee7298592821be00d04159cf21d15af3ffc6

SHA256
6c3ec6547ba6494cd2e6b3d0bd3de13e469de19c2e6270605855f404e27ac414

SHA512
046401e8078aef8e1c0f4d614258c6f63958e34e4121e4e6eaad04c44b5c66683d665564ea93c6cde53a72846684aac5ef429c816fcaae7614f1db523f04c402

Download Submit
memory/468-75-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/468-82-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-65-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1916-83-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1916-84-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing