94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

General

Target

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Size

170KB
MD5

4ab95a184896edf04ec14b32b701bd4d
SHA1

1d50e88dea2b5b4b4508827a9224b8ef0f718dc7
SHA256

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3
SHA512

ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed
SSDEEP

3072:22FiJ+yTKhW6wVkhcVUKdTctzath6K0gyw3MSsx/GsyllR2AGABPlb9CJu+:ri8SKgPCcCScuh69AMSK/Glv2vqOJu

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid process

4184 94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid	process
4184	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\side = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\side.exe"	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process	target process
PID 4776 set thread context of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

pid	process
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description pid process

Token: SeDebugPrivilege 4776 94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process
Token: SeDebugPrivilege	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

description	pid	process	target process
PID 4776 wrote to memory of 4644	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4644	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4644	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4504	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4504	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4504	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	CMD.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
PID 4776 wrote to memory of 4184	4776	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe	94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
"C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:4644

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
"C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe"
2⤵
- Executes dropped EXE
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3.exe
Filesize
170KB

MD5
4ab95a184896edf04ec14b32b701bd4d

SHA1
1d50e88dea2b5b4b4508827a9224b8ef0f718dc7

SHA256
94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

SHA512
ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\side.exe
Filesize
170KB

MD5
4ab95a184896edf04ec14b32b701bd4d

SHA1
1d50e88dea2b5b4b4508827a9224b8ef0f718dc7

SHA256
94a4f9fcfbfce04a4851b8077c51380f693ffc8daa328d96e64a0d630e1e0cf3

SHA512
ed89a2eb326ac339b098f27c06a82434ffb9f7cb2c998f17f625dfd1bcd939d17cdc46bf0e6bd4183f86b84b3bd57e5fd357da08fdb82b22710c93fb4ad505ed

Download Submit
memory/4184-137-0x0000000000000000-mapping.dmp

Download
memory/4184-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4184-140-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4184-141-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4504-134-0x0000000000000000-mapping.dmp

Download
memory/4644-133-0x0000000000000000-mapping.dmp

Download
memory/4776-132-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4776-136-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads