e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5

General

Target

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
Size

202KB
MD5

acc5cc302ef1db44090ff734b6467e53
SHA1

f539e077325e8df0da44fd7caaae7755a8fc2b67
SHA256

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5
SHA512

5d9ad2526638c1e65c7236a94189634e77c84dd010a7776acf64e9f02a693fc398f5f2d0112b0825b70118e3bc5e2f1a61653936deab2993dc012031b0906442
SSDEEP

3072:NK4pAKaF0+xVf/qLkmpZ+rjmuHLBKeAYs5FT0nvvgJZdsVNwoCv:NlaF0uV6LkmLgmbws5FT0ngJZ6Nwoc

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

steamwebhelper.exe

pid process

1972 steamwebhelper.exe
Loads dropped DLL 1 IoCs

Processes:

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe

pid process

748 e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe

pid	process
1972	steamwebhelper.exe

pid	process
748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exesteamwebhelper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exesteamwebhelper.exe

pid process

748 e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
1972 steamwebhelper.exe

pid	process
748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
1972	steamwebhelper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exesteamwebhelper.exe

description	pid	process
Token: SeDebugPrivilege	748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
Token: SeDebugPrivilege	1972	steamwebhelper.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe

description	pid	process	target process
PID 748 wrote to memory of 1972	748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe	steamwebhelper.exe
PID 748 wrote to memory of 1972	748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe	steamwebhelper.exe
PID 748 wrote to memory of 1972	748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe	steamwebhelper.exe
PID 748 wrote to memory of 1972	748	e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe	steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe
"C:\Users\Admin\AppData\Local\Temp\e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
"C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
202KB

MD5
acc5cc302ef1db44090ff734b6467e53

SHA1
f539e077325e8df0da44fd7caaae7755a8fc2b67

SHA256
e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5

SHA512
5d9ad2526638c1e65c7236a94189634e77c84dd010a7776acf64e9f02a693fc398f5f2d0112b0825b70118e3bc5e2f1a61653936deab2993dc012031b0906442

Download Submit
C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
202KB

MD5
acc5cc302ef1db44090ff734b6467e53

SHA1
f539e077325e8df0da44fd7caaae7755a8fc2b67

SHA256
e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5

SHA512
5d9ad2526638c1e65c7236a94189634e77c84dd010a7776acf64e9f02a693fc398f5f2d0112b0825b70118e3bc5e2f1a61653936deab2993dc012031b0906442

Download Submit
\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
202KB

MD5
acc5cc302ef1db44090ff734b6467e53

SHA1
f539e077325e8df0da44fd7caaae7755a8fc2b67

SHA256
e8861345662885f0b056f5046ed701ba0f5b1db3875464ec86da5bb1244a02a5

SHA512
5d9ad2526638c1e65c7236a94189634e77c84dd010a7776acf64e9f02a693fc398f5f2d0112b0825b70118e3bc5e2f1a61653936deab2993dc012031b0906442

Download Submit
memory/748-54-0x0000000000DF0000-0x0000000000E28000-memory.dmp

Filesize
224KB

Download
memory/748-55-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/748-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1972-58-0x0000000000000000-mapping.dmp

Download
memory/1972-61-0x0000000000A10000-0x0000000000A48000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads