e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0

General

Target

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1108 cmd.exe

pid	process
1108	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhohjter.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\dhohjter.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe

description	pid	process	target process
PID 112 set thread context of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exee01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exeExplorer.EXE

pid	process
112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
Token: SeDebugPrivilege	1380	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe

pid	process
112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE

pid	process
1380	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exee01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exeExplorer.EXE

description	pid	process	target process
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 112 wrote to memory of 1956	112	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
PID 1956 wrote to memory of 1108	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	cmd.exe
PID 1956 wrote to memory of 1108	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	cmd.exe
PID 1956 wrote to memory of 1108	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	cmd.exe
PID 1956 wrote to memory of 1108	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	cmd.exe
PID 1956 wrote to memory of 1380	1956	e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe	Explorer.EXE
PID 1380 wrote to memory of 1228	1380	Explorer.EXE	taskhost.exe
PID 1380 wrote to memory of 1320	1380	Explorer.EXE	Dwm.exe
PID 1380 wrote to memory of 1108	1380	Explorer.EXE	cmd.exe
PID 1380 wrote to memory of 2044	1380	Explorer.EXE	conhost.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
"C:\Users\Admin\AppData\Local\Temp\e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112

C:\Users\Admin\AppData\Local\Temp\e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
C:\Users\Admin\AppData\Local\Temp\e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms67357.bat"
4⤵
- Deletes itself
PID:1108

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1228

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-163567159519024212811965241654-722554485-542644174-6925929103549883261279302144"
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms67357.bat
Filesize
200B

MD5
1adc2bf9f7f031e93d65dd1fa643a90f

SHA1
478a2d394af70db345ee7bedd6da06768aee5044

SHA256
1a2da44b4bdd4ec5f4af1fa52f9273bcb12dadc18ab3cea695816002ca7c79ad

SHA512
20a490b1ef1ae5d603f4ff7453635edfb919245b2bc9a8626442a7a8308167af5130e6ef110d7693b4dfe2db32b9130eb523aa935d405007afdb7c7d9d4d9b71

Download Submit
memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/1108-80-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1108-71-0x0000000000000000-mapping.dmp

Download
memory/1228-90-0x0000000001B90000-0x0000000001BA7000-memory.dmp

Filesize
92KB

Download
memory/1228-81-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1320-91-0x00000000019D0000-0x00000000019E7000-memory.dmp

Filesize
92KB

Download
memory/1320-83-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1380-89-0x0000000001D10000-0x0000000001D27000-memory.dmp

Filesize
92KB

Download
memory/1380-92-0x0000000001D10000-0x0000000001D27000-memory.dmp

Filesize
92KB

Download
memory/1380-75-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1380-72-0x0000000001D10000-0x0000000001D27000-memory.dmp

Filesize
92KB

Download
memory/1956-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-65-0x00000000004010C0-mapping.dmp

Download
memory/1956-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-86-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/2044-88-0x00000000001E0000-0x00000000001F7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads