91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0

General

Target

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
Size

77KB
MD5

3462fc56c22abe31f355e1f3c5bd295e
SHA1

7fb9965ebdea385f492a5c6fc97e2850c10067ad
SHA256

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0
SHA512

61442190a8f361cb44e3e96dbccefd478d832daf1709a61931abaf459987d680c6d88a9227581553dc51590c211f75369a63002e6a1cfe491c4ca7c20fa87b46
SSDEEP

1536:RjJFiSGOr8G49QsIl1azj+wisAHYyrCzDeEmPxbPBUo1+byjnRJ/yO:Rj76Or8G4Klkj+wisAH//PBUofL6O

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

1156 netsh.exe
872 netsh.exe

pid	process
1156	netsh.exe
872	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\tWaDLkO = "C:\\Users\\Admin\\AppData\\Roaming\\tWaDLkO\\tWaDLkO.exe"	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

description	ioc	process
File opened (read-only)	\??\K:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\L:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\Q:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\E:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\F:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\H:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\I:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\J:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\S:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\T:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\U:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\Y:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\M:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\P:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\V:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\W:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\X:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\G:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\N:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\O:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\Z:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\B:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
File opened (read-only)	\??\R:	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

pid process

1440 91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

description pid process

Token: SeDebugPrivilege 1440 91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

pid	process
1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

description	pid	process
Token: SeDebugPrivilege	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe

description	pid	process	target process
PID 1440 wrote to memory of 1156	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 1156	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 1156	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 1156	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 872	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 872	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 872	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 872	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	netsh.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 1224	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	notepad.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1924	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	charmap.exe
PID 1440 wrote to memory of 1148	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	taskhost.exe
PID 1440 wrote to memory of 1148	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	taskhost.exe
PID 1440 wrote to memory of 1240	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	Dwm.exe
PID 1440 wrote to memory of 1240	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	Dwm.exe
PID 1440 wrote to memory of 1272	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	Explorer.EXE
PID 1440 wrote to memory of 1272	1440	91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe
"C:\Users\Admin\AppData\Local\Temp\91c11d26188e5a5b73bb5ca07ac2541a9fd177862e7041017e1a2314ce2f52b0.exe"
2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\netsh.exe
firewall add rule name="Internet Explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:1156

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
PID:1224

C:\Windows\SysWOW64\netsh.exe
firewall add allowedprogram mode=ENABLE profile=ALL name="Internet Explore" program="C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe"
3⤵
- Modifies Windows Firewall
PID:872

C:\Windows\SysWOW64\charmap.exe
"C:\Windows\system32\charmap.exe"
3⤵
PID:1924

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1240

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-57-0x0000000000000000-mapping.dmp

Download
memory/1156-55-0x0000000000000000-mapping.dmp

Download
memory/1224-56-0x0000000000000000-mapping.dmp

Download
memory/1440-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1440-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1440-63-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1924-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads