de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6

General

Target

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
Size

662KB
MD5

aed446c8d5735d9595477e57120ce543
SHA1

a1af320dc490e81546aaba5199d54a746827972e
SHA256

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6
SHA512

807eb48e704f4c4b41d5a37af42648de8d48b259d5d9bb60b425018bfc02da8518fa955389349ecd40d42cc2d3407af150ebf739785dec2e00aaad8a29198bff
SSDEEP

12288:yhGB2UFzMZCECSGQD8DGM9mvqcvoUw1QvifviUkx/J8W:yhGWZCNS7qRAno1QuiUu

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

alter.exe

pid process

1456 alter.exe
Deletes itself 1 IoCs

Processes:

alter.exe

pid process

1456 alter.exe
Loads dropped DLL 1 IoCs

Processes:

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe

pid process

2020 de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe

pid	process
1456	alter.exe

pid	process
1456	alter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

alter.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\alter.exe"	alter.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	alter.exe

Drops file in Windows directory 2 IoCs

Processes:

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exealter.exe

description	ioc	process
File opened for modification	C:\Windows\de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.INI	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
File opened for modification	C:\Windows\alter.INI	alter.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

alter.exe

pid process

1456 alter.exe
1456 alter.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1188
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

alter.exe

pid process

1456 alter.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeDebugPrivilege 1188
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1188
1188
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1188
1188

pid	process
1456	alter.exe
1456	alter.exe

pid	process
1188

pid	process
1456	alter.exe

description	pid	process
Token: SeDebugPrivilege	1188

pid	process
1188
1188

pid	process
1188
1188

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exealter.exe

pid	process
2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
1456	alter.exe
1456	alter.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exealter.exe

pid process

2020 de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
1456 alter.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe

description	pid	process	target process
PID 2020 wrote to memory of 1456	2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe	alter.exe
PID 2020 wrote to memory of 1456	2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe	alter.exe
PID 2020 wrote to memory of 1456	2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe	alter.exe
PID 2020 wrote to memory of 1456	2020	de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe	alter.exe

C:\Users\Admin\AppData\Local\Temp\de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
"C:\Users\Admin\AppData\Local\Temp\de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\alter.exe
C:\Users\Admin\AppData\Local\Temp\de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6.exe
2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\alter.exe

Filesize
662KB

MD5
aed446c8d5735d9595477e57120ce543

SHA1
a1af320dc490e81546aaba5199d54a746827972e

SHA256
de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6

SHA512
807eb48e704f4c4b41d5a37af42648de8d48b259d5d9bb60b425018bfc02da8518fa955389349ecd40d42cc2d3407af150ebf739785dec2e00aaad8a29198bff

Download Submit
\Users\Admin\AppData\Local\alter.exe

Filesize
662KB

MD5
aed446c8d5735d9595477e57120ce543

SHA1
a1af320dc490e81546aaba5199d54a746827972e

SHA256
de0262dcd5d406fa549cca0542d71a5961ab1a51cfb22e249b58e33f6579ece6

SHA512
807eb48e704f4c4b41d5a37af42648de8d48b259d5d9bb60b425018bfc02da8518fa955389349ecd40d42cc2d3407af150ebf739785dec2e00aaad8a29198bff

Download Submit
memory/1188-65-0x0000000002230000-0x000000000227D000-memory.dmp

Filesize
308KB

Download
memory/1188-66-0x0000000002A90000-0x0000000002AE2000-memory.dmp

Filesize
328KB

Download
memory/1188-68-0x0000000002A90000-0x0000000002AE2000-memory.dmp

Filesize
328KB

Download
memory/1456-58-0x0000000000000000-mapping.dmp

Download
memory/1456-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1456-67-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2020-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2020-60-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads