accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163

General

Target

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
Size

136KB
MD5

4c8822dab709726b0f02125a8ea28dc5
SHA1

526cb3cc2d7eafa5f3db04d799c7df5bf29ee6a8
SHA256

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163
SHA512

866d8fe9525aa6ab6330ff14e73b68c0f5dc92696687d7fa2e0e7155c6d3ca86dde7e6de95c55cbcb920dffd33306425d8bbae1d214e40b66d6b25b80d15cba0
SSDEEP

3072:bEH+GiEs2SMylNOjyFbxJQ5eNLOxPAkRckhu5pYAQruaZ6Mv:bsehzRF/LmRcD42JE

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ucbr.exe

pid process

1484 ucbr.exe

pid	process
1484	ucbr.exe

Loads dropped DLL 3 IoCs

Processes:

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exeucbr.exe

pid	process
1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
1484	ucbr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

description	pid	process	target process
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 1900 wrote to memory of 1484	1900	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe

C:\Users\Admin\AppData\Local\Temp\accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
"C:\Users\Admin\AppData\Local\Temp\accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe

Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe

Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe

Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe

Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe

Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
memory/1484-57-0x0000000000000000-mapping.dmp

Download
memory/1900-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads