1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65

General

Target

1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
Size

267KB
MD5

0d2a33308a19ebc24ddaef450cc65268
SHA1

7ba0923b3a44af654025fba884c5df0fc0501453
SHA256

1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65
SHA512

8382920d4502a520ab53d4cebbc5a5233461648eabc2b8f07f439b2c287f5ecd6ba1640666940034cedfbb7c77fb48c8c904f95939e3fec47de6e6a2321963c9
SSDEEP

6144:KxZaok06CN5fmVQH0heA8nXiUSz7ArwAVpN2u6:Ke015+Vq+8XrqMbVpI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2376	BeyMOHF4qg9VrI.exe
4500	BeyMOHF4qg9VrI.exe

Loads dropped DLL 4 IoCs

pid	Process
3796	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
3796	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
4500	BeyMOHF4qg9VrI.exe
4500	BeyMOHF4qg9VrI.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YmjKEDAVEh = "C:\\ProgramData\\WQi4p7t5IuWt\\BeyMOHF4qg9VrI.exe"	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3680 set thread context of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 2376 set thread context of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 4500 set thread context of 3144	4500	BeyMOHF4qg9VrI.exe	84

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 3680 wrote to memory of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 3680 wrote to memory of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 3680 wrote to memory of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 3680 wrote to memory of 3796	3680	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	81
PID 3796 wrote to memory of 2376	3796	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	82
PID 3796 wrote to memory of 2376	3796	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	82
PID 3796 wrote to memory of 2376	3796	1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe	82
PID 2376 wrote to memory of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 2376 wrote to memory of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 2376 wrote to memory of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 2376 wrote to memory of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 2376 wrote to memory of 4500	2376	BeyMOHF4qg9VrI.exe	83
PID 4500 wrote to memory of 3144	4500	BeyMOHF4qg9VrI.exe	84
PID 4500 wrote to memory of 3144	4500	BeyMOHF4qg9VrI.exe	84
PID 4500 wrote to memory of 3144	4500	BeyMOHF4qg9VrI.exe	84
PID 4500 wrote to memory of 3144	4500	BeyMOHF4qg9VrI.exe	84
PID 4500 wrote to memory of 3144	4500	BeyMOHF4qg9VrI.exe	84

C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
"C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe
  "C:\Users\Admin\AppData\Local\Temp\1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe
    "C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe
      "C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
        
        "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /i:4500
        5⤵
        
        PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe

Filesize
267KB

MD5
0d2a33308a19ebc24ddaef450cc65268

SHA1
7ba0923b3a44af654025fba884c5df0fc0501453

SHA256
1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65

SHA512
8382920d4502a520ab53d4cebbc5a5233461648eabc2b8f07f439b2c287f5ecd6ba1640666940034cedfbb7c77fb48c8c904f95939e3fec47de6e6a2321963c9

Download Submit
C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe

Filesize
267KB

MD5
0d2a33308a19ebc24ddaef450cc65268

SHA1
7ba0923b3a44af654025fba884c5df0fc0501453

SHA256
1750e40308419b4c7e4ee7934cd48b469718fcc0288090eac828b9d3b636fd65

SHA512
8382920d4502a520ab53d4cebbc5a5233461648eabc2b8f07f439b2c287f5ecd6ba1640666940034cedfbb7c77fb48c8c904f95939e3fec47de6e6a2321963c9

Download Submit
C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe

Filesize
267KB

MD5
de55afd335f84e39ef48202431b82de5

SHA1
1aaf91f5549df1bf65a1d8caba159ced834171f3

SHA256
3e404eba09be075fee9d4f85397558ae416ff6b30757899f6211055794b28803

SHA512
b072362388200f21aec9b99eff9afafc0e5d7c82e83704c1d056c72cd22542282c3fa866a8f51e481694146c88b8968b7dc152c7e1f63f0a9540460e3cdcb3a0

Download Submit
C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe

Filesize
267KB

MD5
de55afd335f84e39ef48202431b82de5

SHA1
1aaf91f5549df1bf65a1d8caba159ced834171f3

SHA256
3e404eba09be075fee9d4f85397558ae416ff6b30757899f6211055794b28803

SHA512
b072362388200f21aec9b99eff9afafc0e5d7c82e83704c1d056c72cd22542282c3fa866a8f51e481694146c88b8968b7dc152c7e1f63f0a9540460e3cdcb3a0

Download Submit
C:\ProgramData\WQi4p7t5IuWt\BeyMOHF4qg9VrI.exe

Filesize
267KB

MD5
de55afd335f84e39ef48202431b82de5

SHA1
1aaf91f5549df1bf65a1d8caba159ced834171f3

SHA256
3e404eba09be075fee9d4f85397558ae416ff6b30757899f6211055794b28803

SHA512
b072362388200f21aec9b99eff9afafc0e5d7c82e83704c1d056c72cd22542282c3fa866a8f51e481694146c88b8968b7dc152c7e1f63f0a9540460e3cdcb3a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\JwDBHYy1c4O2eo.exe

Filesize
267KB

MD5
de55afd335f84e39ef48202431b82de5

SHA1
1aaf91f5549df1bf65a1d8caba159ced834171f3

SHA256
3e404eba09be075fee9d4f85397558ae416ff6b30757899f6211055794b28803

SHA512
b072362388200f21aec9b99eff9afafc0e5d7c82e83704c1d056c72cd22542282c3fa866a8f51e481694146c88b8968b7dc152c7e1f63f0a9540460e3cdcb3a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\JwDBHYy1c4O2eo.exe

Filesize
267KB

MD5
de55afd335f84e39ef48202431b82de5

SHA1
1aaf91f5549df1bf65a1d8caba159ced834171f3

SHA256
3e404eba09be075fee9d4f85397558ae416ff6b30757899f6211055794b28803

SHA512
b072362388200f21aec9b99eff9afafc0e5d7c82e83704c1d056c72cd22542282c3fa866a8f51e481694146c88b8968b7dc152c7e1f63f0a9540460e3cdcb3a0

Download Submit
memory/3144-156-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3796-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3796-138-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3796-133-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3796-142-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3796-135-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4500-155-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4500-150-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing