dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036

General

Target

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
Size

1.3MB
MD5

4c8e133d2db60d59c5097f8dc15a4fa5
SHA1

db20f37ba5909907e644caa6d732f0b2fb13adbd
SHA256

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036
SHA512

694d3f5ab561f4480584141368ceee79595ab7802997058242b6e119d795546ba95c35063112f22549b47090e67d4e1bef5832ae5d95097dcfdb5c1f62650e62
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakx:7rKo4ZwCOnYjVmJPaC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

description	pid	process	target process
PID 524 set thread context of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

pid	process
584	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
584	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
584	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
584	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
584	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

description	pid	process	target process
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
PID 524 wrote to memory of 584	524	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe	dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe

C:\Users\Admin\AppData\Local\Temp\dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
"C:\Users\Admin\AppData\Local\Temp\dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\dc6f09cbe979003edb471b54e1a9ea931e073f26598097dcba12408822779036.exe
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-66-0x000000000044E057-mapping.dmp

Download
memory/584-68-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/584-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads