94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

General

Target

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Size

170KB
MD5

4ab95a184896edf04ec14b32b701bd4d
SHA1

1d50e88dea2b5b4b4508827a9224b8ef0f718dc7
SHA256

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3
SHA512

ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed
SSDEEP

3072:22FiJ+yTKhW6wVkhcVUKdTctzath6K0gyw3MSsx/GsyllR2AGABPlb9CJu+:ri8SKgPCcCScuh69AMSK/Glv2vqOJu

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid process

568 94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Loads dropped DLL 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid process

892 94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid	process
568	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\side = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\side.exe"	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process	target process
PID 892 set thread context of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid	process
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description pid process

Token: SeDebugPrivilege 892 94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process
Token: SeDebugPrivilege	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process	target process
PID 892 wrote to memory of 1000	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1000	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1000	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1000	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1364	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1364	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1364	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 1364	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 892 wrote to memory of 568	892	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
"C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1000

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
"C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe"
2⤵
- Executes dropped EXE
PID:568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Filesize
170KB

MD5
4ab95a184896edf04ec14b32b701bd4d

SHA1
1d50e88dea2b5b4b4508827a9224b8ef0f718dc7

SHA256
94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

SHA512
ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\side.exe
Filesize
170KB

MD5
4ab95a184896edf04ec14b32b701bd4d

SHA1
1d50e88dea2b5b4b4508827a9224b8ef0f718dc7

SHA256
94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

SHA512
ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed

Download Submit
\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Filesize
170KB

MD5
4ab95a184896edf04ec14b32b701bd4d

SHA1
1d50e88dea2b5b4b4508827a9224b8ef0f718dc7

SHA256
94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

SHA512
ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed

Download Submit
memory/568-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-75-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/568-60-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-61-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-73-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/568-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-69-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-66-0x000000000043B58E-mapping.dmp

Download
memory/892-55-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/892-54-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/892-74-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1000-56-0x0000000000000000-mapping.dmp

Download
memory/1364-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads