ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7

General

Target

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
Size

1.2MB
MD5

1edf1ec41b56c782ea1d4fd1148dc3b5
SHA1

85cd87cdf7c7a1d8c2074274c14d960e0b47751e
SHA256

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7
SHA512

a0bc5c84b970a27784dab8e9ef6b388a28aa4b6e2bf4582d52356005b7f5b8c0bc3f1492264ef324807bdaba75d56bc7606946716d20e8bdbdfce168fc23f501
SSDEEP

24576:5bkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42CA:uqvCEaRkca2Yb/3PmKxq9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

description	pid	process	target process
PID 428 set thread context of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

pid	process
2004	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2004	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2004	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2004	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2004	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

description	pid	process	target process
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 428 wrote to memory of 2004	428	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
"C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:428

C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-55-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-57-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-59-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-61-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-63-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-66-0x000000000044C920-mapping.dmp

Download
memory/2004-65-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-68-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/2004-69-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-70-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-71-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2004-73-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads