b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0

General

Target

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe
Size

1.8MB
MD5

be97f4e7d6f818daa91958271369bd8b
SHA1

103fca3dc5ea42ab34bb40e5f817cc7ff66347aa
SHA256

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0
SHA512

4dddd27fb9385e4b202ce015023b0c3edea57905417f5d861fed3cd9d3cdf465a025cf45bc2fd4b16e821b786f6c625c3c5c1009715120d536fe444f88307c84
SSDEEP

49152:gCQ0U/SJPVaJuPh4QwEvLX4f48dwUtzLN:gJXShRbLXd8Z

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Iexplorer.exe

pid process

1328 Iexplorer.exe
Drops startup file 1 IoCs

Processes:

Iexplorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win7.exe Iexplorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win7.exe	Iexplorer.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MOZILLA = "C:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Firefox = "C:\\Program Files\\Mozilla Firefox\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mp = "C:\\Arquivos de programas\\player.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\temp = "C:\\Windows\\Temp\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seb = "C:\\Program Files\\GbPlugin\\seb.exe"	regedit.exe

Drops file in Program Files directory 3 IoCs

Processes:

Iexplorer.exe

description	ioc	process
File created	C:\Program Files\GbPlugin\seb.exe	Iexplorer.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	Iexplorer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Iexplorer.exe

Drops file in Windows directory 2 IoCs

Processes:

Iexplorer.exe

description ioc process

File created C:\Windows\Regs.reg Iexplorer.exe
File created C:\WINDOWS\aviso.bak Iexplorer.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1632 regedit.exe

description	ioc	process
File created	C:\Windows\Regs.reg	Iexplorer.exe
File created	C:\WINDOWS\aviso.bak	Iexplorer.exe

pid	process
1632	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Iexplorer.exe

pid	process
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe
1328	Iexplorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Iexplorer.exe

pid process

1328 Iexplorer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Iexplorer.exe

pid process

1328 Iexplorer.exe
1328 Iexplorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exeIexplorer.execmd.exe

description	pid	process	target process
PID 3492 wrote to memory of 1328	3492	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 3492 wrote to memory of 1328	3492	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 3492 wrote to memory of 1328	3492	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 1328 wrote to memory of 3396	1328	Iexplorer.exe	cmd.exe
PID 1328 wrote to memory of 3396	1328	Iexplorer.exe	cmd.exe
PID 1328 wrote to memory of 3396	1328	Iexplorer.exe	cmd.exe
PID 3396 wrote to memory of 1632	3396	cmd.exe	regedit.exe
PID 3396 wrote to memory of 1632	3396	cmd.exe	regedit.exe
PID 3396 wrote to memory of 1632	3396	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe
"C:\Users\Admin\AppData\Local\Temp\b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Windows\Temp\Iexplorer.exe
C:\Windows\Temp\Iexplorer.exe
2⤵
- Executes dropped EXE
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /k regedit /s %windir%\Regs.reg
3⤵
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\Regs.reg
4⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Regs.reg

Filesize
370B

MD5
fcf7aa57c5f619ff66d8904d27cfbba6

SHA1
ca436c3e353a3dc4dac11627e9eeb8bcc5f94a0d

SHA256
4d27c0fe4717d7efbb41a141599cb1633771aa6a262e2f5aa0b3faf2512d4ef0

SHA512
3eaff73d43bb35f943fac695c49d84bb2c070131a85301bdd1bcf7411c8481ee08d22e75092959816d004c7e708e3f7f1420e1b2a13439a997870486432e716d

Download Submit
C:\Windows\Temp\Iexplorer.exe

Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
C:\Windows\Temp\Iexplorer.exe

Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
memory/1328-132-0x0000000000000000-mapping.dmp

Download
memory/1328-136-0x0000000000400000-0x0000000002209000-memory.dmp

Filesize
30.0MB

Download
memory/1328-139-0x0000000000400000-0x0000000002209000-memory.dmp

Filesize
30.0MB

Download
memory/1632-137-0x0000000000000000-mapping.dmp

Download
memory/3396-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads