ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466

General

Target

ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
Size

305KB
MD5

cafbe1859caa83efc27f2f64b82af6ce
SHA1

2d96fab0eaf7b49705623a95f3e7da871bea4b8c
SHA256

ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466
SHA512

db1f5fcff77cd375aff8e6a9fec634458addf05061dcb185fa980687fd2d296af38945254e18382ea2df2488a174e3b8c64219b95ab0476508a959e731052a5e
SSDEEP

6144:NO71gi4TG15/eG4VkWwJWcjEpCiW3JBo3QGSc2TAj0Hmeg1:N4+52kG+k7JWEunmJOLITPHmt1

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ofyxer.exe

pid process

2252 ofyxer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ofyxer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	ofyxer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ofyxer = "C:\\Users\\Admin\\AppData\\Roaming\\Peygs\\ofyxer.exe"	ofyxer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe

description pid process target process

PID 2688 set thread context of 872 2688 ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe cmd.exe

description	pid	process	target process
PID 2688 set thread context of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

ofyxer.exe

pid	process
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe
2252	ofyxer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exeofyxer.exe

description	pid	process	target process
PID 2688 wrote to memory of 2252	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	ofyxer.exe
PID 2688 wrote to memory of 2252	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	ofyxer.exe
PID 2688 wrote to memory of 2252	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	ofyxer.exe
PID 2252 wrote to memory of 2480	2252	ofyxer.exe	sihost.exe
PID 2252 wrote to memory of 2480	2252	ofyxer.exe	sihost.exe
PID 2252 wrote to memory of 2480	2252	ofyxer.exe	sihost.exe
PID 2252 wrote to memory of 2480	2252	ofyxer.exe	sihost.exe
PID 2252 wrote to memory of 2480	2252	ofyxer.exe	sihost.exe
PID 2252 wrote to memory of 2500	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 2500	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 2500	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 2500	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 2500	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 2740	2252	ofyxer.exe	taskhostw.exe
PID 2252 wrote to memory of 2740	2252	ofyxer.exe	taskhostw.exe
PID 2252 wrote to memory of 2740	2252	ofyxer.exe	taskhostw.exe
PID 2252 wrote to memory of 2740	2252	ofyxer.exe	taskhostw.exe
PID 2252 wrote to memory of 2740	2252	ofyxer.exe	taskhostw.exe
PID 2252 wrote to memory of 2596	2252	ofyxer.exe	Explorer.EXE
PID 2252 wrote to memory of 2596	2252	ofyxer.exe	Explorer.EXE
PID 2252 wrote to memory of 2596	2252	ofyxer.exe	Explorer.EXE
PID 2252 wrote to memory of 2596	2252	ofyxer.exe	Explorer.EXE
PID 2252 wrote to memory of 2596	2252	ofyxer.exe	Explorer.EXE
PID 2252 wrote to memory of 1080	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 1080	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 1080	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 1080	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 1080	2252	ofyxer.exe	svchost.exe
PID 2252 wrote to memory of 3268	2252	ofyxer.exe	DllHost.exe
PID 2252 wrote to memory of 3268	2252	ofyxer.exe	DllHost.exe
PID 2252 wrote to memory of 3268	2252	ofyxer.exe	DllHost.exe
PID 2252 wrote to memory of 3268	2252	ofyxer.exe	DllHost.exe
PID 2252 wrote to memory of 3268	2252	ofyxer.exe	DllHost.exe
PID 2252 wrote to memory of 3364	2252	ofyxer.exe	StartMenuExperienceHost.exe
PID 2252 wrote to memory of 3364	2252	ofyxer.exe	StartMenuExperienceHost.exe
PID 2252 wrote to memory of 3364	2252	ofyxer.exe	StartMenuExperienceHost.exe
PID 2252 wrote to memory of 3364	2252	ofyxer.exe	StartMenuExperienceHost.exe
PID 2252 wrote to memory of 3364	2252	ofyxer.exe	StartMenuExperienceHost.exe
PID 2252 wrote to memory of 3432	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3432	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3432	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3432	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3432	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3528	2252	ofyxer.exe	SearchApp.exe
PID 2252 wrote to memory of 3528	2252	ofyxer.exe	SearchApp.exe
PID 2252 wrote to memory of 3528	2252	ofyxer.exe	SearchApp.exe
PID 2252 wrote to memory of 3528	2252	ofyxer.exe	SearchApp.exe
PID 2252 wrote to memory of 3528	2252	ofyxer.exe	SearchApp.exe
PID 2252 wrote to memory of 3676	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3676	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3676	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3676	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 3676	2252	ofyxer.exe	RuntimeBroker.exe
PID 2252 wrote to memory of 2688	2252	ofyxer.exe	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
PID 2252 wrote to memory of 2688	2252	ofyxer.exe	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
PID 2252 wrote to memory of 2688	2252	ofyxer.exe	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
PID 2252 wrote to memory of 2688	2252	ofyxer.exe	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
PID 2252 wrote to memory of 2688	2252	ofyxer.exe	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe
PID 2688 wrote to memory of 872	2688	ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe	cmd.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1080

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3364

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3268

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe
"C:\Users\Admin\AppData\Local\Temp\ea67d3e64b2b29b9e83b2af78ef551ad2f0b4c15eff0740741109daba5f8d466.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Roaming\Peygs\ofyxer.exe
"C:\Users\Admin\AppData\Roaming\Peygs\ofyxer.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\LBL655F.bat"
3⤵
PID:872

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LBL655F.bat

Filesize
303B

MD5
ac60093451b3513170af124f6cddf53b

SHA1
960a7ef2fd37d5ba2eefec594869335a19cd4488

SHA256
909eeb4a112371b7cd96a04b1eb0f0d54e0a0a1127ce743dfddec06707affcf6

SHA512
76f9d3c213919e4e66058215534e5591cff3849a248df2faf8191cbf57439e3168f6ebc7636ed253d2915aba1034915ea3f05d51b3b6963417338d0f577f21ea

Download Submit
C:\Users\Admin\AppData\Roaming\Peygs\ofyxer.exe

Filesize
305KB

MD5
061d39b1f420e68701671715f5b2b12d

SHA1
1ae3ecfba8cd777a5d27bae502e59b67f07b4685

SHA256
94d734122eaf322409b329c73a644288c86ebbf7bea034b0ec972e357b3926f1

SHA512
3f21fe9478c4f8c5f42c24c9c9a89bd6348dddf5947575b88b6fa26ba9c40cdf05acc77783986c6194e9907b7056416e6a49ab453789e88730ab9b1ba538f63e

Download Submit
C:\Users\Admin\AppData\Roaming\Peygs\ofyxer.exe

Filesize
305KB

MD5
061d39b1f420e68701671715f5b2b12d

SHA1
1ae3ecfba8cd777a5d27bae502e59b67f07b4685

SHA256
94d734122eaf322409b329c73a644288c86ebbf7bea034b0ec972e357b3926f1

SHA512
3f21fe9478c4f8c5f42c24c9c9a89bd6348dddf5947575b88b6fa26ba9c40cdf05acc77783986c6194e9907b7056416e6a49ab453789e88730ab9b1ba538f63e

Download Submit
memory/872-150-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-149-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-156-0x0000000001200000-0x0000000001249000-memory.dmp

Filesize
292KB

Download
memory/872-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-151-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/872-145-0x0000000000000000-mapping.dmp

Download
memory/872-146-0x0000000001200000-0x0000000001249000-memory.dmp

Filesize
292KB

Download
memory/872-148-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2252-137-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2252-134-0x0000000000000000-mapping.dmp

Download
memory/2688-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2688-147-0x0000000002270000-0x00000000022B9000-memory.dmp

Filesize
292KB

Download
memory/2688-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2688-132-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2688-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2688-141-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2688-140-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2688-133-0x0000000000401000-0x0000000000442000-memory.dmp

Filesize
260KB

Download
memory/2688-139-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads