5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc

General

Target

5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
Size

143KB
MD5

42b74b0dde8c7313e2403b7a93dd4941
SHA1

1b8566d4aca70eb7ee00896188c3b5691cfb8204
SHA256

5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc
SHA512

c188ea28e0b64303ddfbdb2f24f2b9997b923989e621289f7a20ea69bf96a5f85290526fdf51d5185e3b4008e399fbcd133c76bc2d0fd0e438be94c96ae10aff
SSDEEP

3072:iO2T8atgFx6Bj0j1IhD07cDxyy1rbFo8eAvkdQM:32T8Vx6BAIBh6TXd3

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Test11a23 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\17fd1ar8.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Test11a23 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\17fd1ar8.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe

description	pid	process	target process
PID 1896 set thread context of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe

pid	process
1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

explorer.exe

pid process

4740 explorer.exe

pid	process
4740	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe

description	pid	process	target process
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 1896 wrote to memory of 4708	1896	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe
PID 4708 wrote to memory of 4740	4708	5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
"C:\Users\Admin\AppData\Local\Temp\5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe
  "C:\Users\Admin\AppData\Local\Temp\5ec6b178662b0732ac291297f16eb91cd57ddabac303a425236ace270bb0c0bc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: RenamesItself
    PID:4740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-132-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download
memory/4708-133-0x0000000000000000-mapping.dmp

Download
memory/4708-134-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4708-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4740-137-0x0000000000000000-mapping.dmp

Download
memory/4740-138-0x0000000000140000-0x0000000000144000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads