d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47

General

Target

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
Size

108KB
MD5

e3bc87061d51fa234a9bcd020bbe19d6
SHA1

5e8c17ab5fc5dd554c4f0a227fd667dd1c9d3f2a
SHA256

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47
SHA512

2e08bbcf52f1ef91bb48b8f216e9ae8013c0a4447f0696d5aa147e3a4dbbbbb0b57b47b65c16866f150faf3472a27a30b959aff0c121919234437a0a5322b418
SSDEEP

1536:qlVFlaRehGwmjYeDWe5T62ny1k/jN6pTSedYlmdltlNl5qc2PUvRnJFgW0yR:0PavnxDd5e2ny1c8gNcjJFl0

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	pid	process	target process
PID 1276 set thread context of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid	process
2020	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
2020	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
2020	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid process

1276 d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid	process
1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	pid	process	target process
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 1276 wrote to memory of 2020	1276	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
"C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
"C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2020-57-0x0000000000401F0F-mapping.dmp

Download
memory/2020-59-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2020-60-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/2020-61-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2020-65-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2020-67-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2020-66-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads