61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836

General

Target

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
Size

294KB
MD5

1e11ba672d94a4510ce55c6378c8cdb6
SHA1

c33e6e05b0e7713d33bd9a17e8b41c10e019fce4
SHA256

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836
SHA512

9d34f23959f27843d513044dc6d8d1f53ab04d1f8fe53ed7ce1ea27f703f688495449677eac093351a9c0c698cdf06c4cfcaa57deb838189df2ba45c6ecda077
SSDEEP

6144:cXA71FMhGYcdu1DtD4xhKBO1iT4ICH3Ng61:22FMhGY62DtDzO1iTFW3e61

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\681de19.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\681de19.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\681de1 = "C:\\681de19\\681de19.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*81de1 = "C:\\681de19\\681de19.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\681de19 = "C:\\Users\\Admin\\AppData\\Roaming\\681de19.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*81de19 = "C:\\Users\\Admin\\AppData\\Roaming\\681de19.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

description	pid	process	target process
PID 3828 set thread context of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid	process
3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid process

116 61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

pid	process
116	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe

description	pid	process	target process
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 3828 wrote to memory of 116	3828	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
PID 116 wrote to memory of 1800	116	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe
PID 116 wrote to memory of 1800	116	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe
PID 116 wrote to memory of 1800	116	61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
"C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe
  "C:\Users\Admin\AppData\Local\Temp\61ce6ec62ae5b2e21ef498d8db98e9df5d24eee15cf215f7fe702ff1653ad836.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-132-0x0000000000000000-mapping.dmp

Download
memory/116-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/116-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1800-135-0x0000000000000000-mapping.dmp

Download
memory/1800-137-0x0000000000370000-0x0000000000390000-memory.dmp

Filesize
128KB

Download
memory/3828-134-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads