61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836

General

Target

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
Size

294KB
MD5

1e11ba672d94a4510ce55c6378c8cdb6
SHA1

c33e6e05b0e7713d33bd9a17e8b41c10e019fce4
SHA256

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836
SHA512

9d34f23959f27843d513044dc6d8d1f53ab04d1f8fe53ed7ce1ea27f703f688495449677eac093351a9c0c698cdf06c4cfcaa57deb838189df2ba45c6ecda077
SSDEEP

6144:cXA71FMhGYcdu1DtD4xhKBO1iT4ICH3Ng61:22FMhGY62DtDzO1iTFW3e61

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82b2b9a.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82b2b9a.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\82b2b9 = "C:\\82b2b9a\\82b2b9a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*2b2b9 = "C:\\82b2b9a\\82b2b9a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\82b2b9a = "C:\\Users\\Admin\\AppData\\Roaming\\82b2b9a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*2b2b9a = "C:\\Users\\Admin\\AppData\\Roaming\\82b2b9a.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

description	pid	process	target process
PID 1440 set thread context of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid	process
1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid process

872 61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid	process
872	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

description	pid	process	target process
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 1440 wrote to memory of 872	1440	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 872 wrote to memory of 1452	872	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe
PID 872 wrote to memory of 1452	872	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe
PID 872 wrote to memory of 1452	872	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe
PID 872 wrote to memory of 1452	872	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
"C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
  "C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\syswow64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-62-0x00000000004143B0-mapping.dmp

Download
memory/872-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1440-63-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1452-64-0x0000000000000000-mapping.dmp

Download
memory/1452-66-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1452-67-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1452-68-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads