4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f

General

Target

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
Size

299KB
MD5

43217b2d42063459210ad558ef7295d0
SHA1

f55fd2219558598e2e2c2af839206e65c4dcdd72
SHA256

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f
SHA512

289dc0976b48eca74fc48f124759869f47b3c263369f5000a3dd60fad895b56ea796521b41e3c6aa24b9f29415a5b4e4d87d00cc06a05ca185d3711c79a98c05
SSDEEP

6144:KXr+lex5gfzDVlVXg7OJsZcbYKSXxIN84:ix5GpXA8YKEE8

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ctxmon.exe

pid process

316 ctxmon.exe
Loads dropped DLL 1 IoCs

Processes:

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

pid process

304 4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

pid	process
316	ctxmon.exe

pid	process
304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exectxmon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe"	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

description pid process

Token: SeTakeOwnershipPrivilege 304 4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

description	pid	process	target process
PID 304 wrote to memory of 316	304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	ctxmon.exe
PID 304 wrote to memory of 316	304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	ctxmon.exe
PID 304 wrote to memory of 316	304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	ctxmon.exe
PID 304 wrote to memory of 316	304	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	ctxmon.exe

C:\Users\Admin\AppData\Local\Temp\4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
"C:\Users\Admin\AppData\Local\Temp\4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
memory/304-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/304-60-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download
memory/304-61-0x0000000000190000-0x00000000001C5000-memory.dmp

Filesize
212KB

Download
memory/304-62-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download
memory/304-63-0x0000000000190000-0x00000000001C5000-memory.dmp

Filesize
212KB

Download
memory/316-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing