f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd

General

Target

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
Size

268KB
MD5

0dbfc205acc4442b94f2f969263e9106
SHA1

5e5eb551042b385a93a108ce73e3ada9327d7f4a
SHA256

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd
SHA512

d584839c7e875b9d6dc23a2484278a001396d7e932278618a69047f42c9ae8e335b1fde0545a8e1dda6d99370ca4d33871270ee36975b4d1fcb84cccd3668c30
SSDEEP

3072:XCYJYP5dbdH0jBNBTchbjxMy+SgGYftYZdMQw/hXYvtz6wQA/0ipRZOjbZr85Lci:XCmYBdbdQNRYmxb5hktz6w30E6bKJV8O

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\str.sys	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Drops file in System32 directory 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\nethost.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
File created	C:\Windows\SysWOW64\nethost.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process	target process
PID 1896 set thread context of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 set thread context of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

pid	process
1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process
Token: SeDebugPrivilege	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
Token: SeDebugPrivilege	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process	target process
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1896 wrote to memory of 1880	1896	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1880 wrote to memory of 596	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 596	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 672	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 672	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 748	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 748	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 808	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 808	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 836	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 836	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 872	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 872	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 292	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 292	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 1056	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 1056	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 1828	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 1828	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 1880 wrote to memory of 1268	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	Explorer.EXE
PID 1880 wrote to memory of 1268	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	Explorer.EXE
PID 1880 wrote to memory of 1772	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1880 wrote to memory of 1772	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1880 wrote to memory of 1772	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1880 wrote to memory of 1772	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1880 wrote to memory of 668	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	cmd.exe
PID 1880 wrote to memory of 668	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	cmd.exe
PID 1880 wrote to memory of 668	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	cmd.exe
PID 1880 wrote to memory of 668	1880	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	cmd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 1772 wrote to memory of 920	1772	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:1828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe"
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe" /runmain
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe" /runmain
5⤵
- Drops file in Drivers directory
PID:920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\F24108~1.EXE >> NUL
4⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-69-0x0000000000490000-0x00000000004B3000-memory.dmp

Filesize
140KB

Download
memory/668-91-0x0000000000000000-mapping.dmp

Download
memory/920-108-0x0000000000400000-0x0000000000424565-memory.dmp

Filesize
145KB

Download
memory/920-107-0x00000000002A0000-0x00000000002B1000-memory.dmp

Filesize
68KB

Download
memory/920-106-0x0000000000270000-0x0000000000293000-memory.dmp

Filesize
140KB

Download
memory/920-103-0x0000000000401ADF-mapping.dmp

Download
memory/1772-89-0x0000000000000000-mapping.dmp

Download
memory/1880-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-65-0x0000000000401ADF-mapping.dmp

Download
memory/1880-62-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-61-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-60-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-92-0x0000000000400000-0x0000000000424565-memory.dmp

Filesize
145KB

Download
memory/1880-58-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1880-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1896-66-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/1896-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads