d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7

General

Target

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
Size

246KB
MD5

7aad2531656da0c3ccdd0e670ac2b6fb
SHA1

b84022ae1f3a1c33ca2ac909f9abd4182d9c7c5a
SHA256

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7
SHA512

3f5e491bfd1fe8c5cd3437ee17d15c34706ef0281c9141eca2a4e6ca5013ed6131298a779623df7706bbf68ec351b892124c74d727856a6c0c2fa6ec763a8402
SSDEEP

6144:koLhB9sYlTjrIhzNSna3LFoj9QDux+XH:k0TjizUna3UsX

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

svcnost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svcnost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	svcnost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	svcnost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\svcnost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\\svcnost.exe:*:Enabled:ldrsoft"	svcnost.exe

Drops file in Drivers directory 1 IoCs

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/216-132-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral2/memory/216-133-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral2/memory/3688-135-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3688-137-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3688-138-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3688-139-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4820-141-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral2/memory/4500-147-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3688-149-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4500-153-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

svcnost.exe

pid process

4500 svcnost.exe
4500 svcnost.exe

pid	process
4500	svcnost.exe
4500	svcnost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\\svcnost.exe\""	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svcnost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exesvcnost.exe

description	pid	process	target process
PID 216 set thread context of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 4820 set thread context of 4500	4820	svcnost.exe	svcnost.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

svcnost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry	svcnost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML = 353939313738393031	svcnost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

pid	process
3688	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
3688	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

pid process

3688 d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exed6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exesvcnost.exe

description	pid	process	target process
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 216 wrote to memory of 3688	216	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
PID 3688 wrote to memory of 4820	3688	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	svcnost.exe
PID 3688 wrote to memory of 4820	3688	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	svcnost.exe
PID 3688 wrote to memory of 4820	3688	d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe
PID 4820 wrote to memory of 4500	4820	svcnost.exe	svcnost.exe

C:\Users\Admin\AppData\Local\Temp\d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
"C:\Users\Admin\AppData\Local\Temp\d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
C:\Users\Admin\AppData\Local\Temp\d6cb65a9cdccdfd4ddfbb78e65cad4122e1d4a031b645a819cc229559f8a12c7.exe
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3688

C:\Users\Admin\AppData\Roaming\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\svcnost.exe
"C:\Users\Admin\AppData\Roaming\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\svcnost.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820

C:\Users\Admin\AppData\Roaming\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\svcnost.exe
C:\Users\Admin\AppData\Roaming\x1ginwqdqzjaqcdf32blqv3ngzqmblx22\svcnost.exe
4⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\desktop.ini

Filesize
9KB

MD5
4a27242b307c6a836993353035fafc16

SHA1
5fea7a41b8f9071848108015d8a952e6f944eea0

SHA256
02fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1

SHA512
35e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be

Download Submit
C:\Users\Admin\AppData\Roaming\ntuser.dat

Filesize
54KB

MD5
7e8e966927e04a35aec644602b8a9e05

SHA1
d201b0b41e8701818d60ddbf9f334332a512c4da

SHA256
46f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c

SHA512
246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51

Download Submit
memory/216-132-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/216-133-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3688-137-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3688-138-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3688-139-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3688-149-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3688-135-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3688-134-0x0000000000000000-mapping.dmp

Download
memory/4500-142-0x0000000000000000-mapping.dmp

Download
memory/4500-147-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4500-152-0x0000000000900000-0x000000000091D000-memory.dmp

Filesize
116KB

Download
memory/4500-153-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4820-140-0x0000000000000000-mapping.dmp

Download
memory/4820-141-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads