db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f

General

Target

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
Size

112KB
MD5

f2f06c7759f4c358b23c8ac715e84f29
SHA1

4503a3f34c5a5f4b5315a1dea18f6802143ccdb3
SHA256

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f
SHA512

6a2087e6c64f3abcfa2c09adfac03bb7e71093f5755e1451c2e988ef61776f74b2c4167982b4caa6993016a80494fdd0dc00a7afb73e54af075c99897cb1074d
SSDEEP

3072:IX3mfj1USDsTPYvQG+iIunxeMHrIPbzm7p:tr1U6iP8D+FunTHrInm7

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility32.dll"	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1860 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1652 svchost.exe
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 4.2.2.1

pid	process
1860	cmd.exe

pid	process
1652	svchost.exe

description	ioc
Destination IP	4.2.2.1

Drops file in System32 directory 3 IoCs

Processes:

svchost.exedb71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-63-5b-e6-f1-ac\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}\WpadDecisionTime = 90750af65f00d901	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-63-5b-e6-f1-ac\WpadDecisionTime = 90750af65f00d901	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-63-5b-e6-f1-ac	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}\a2-63-5b-e6-f1-ac	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-63-5b-e6-f1-ac\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7D7C2FA-0086-4E62-BC5C-25CAB86709D3}\WpadDecisionReason = "1"	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	pid	process	target process
PID 1508 wrote to memory of 1860	1508	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe
PID 1508 wrote to memory of 1860	1508	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe
PID 1508 wrote to memory of 1860	1508	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe
PID 1508 wrote to memory of 1860	1508	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
"C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe"
2⤵
- Deletes itself
PID:1860

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility32.dll

Filesize
15KB

MD5
90c3324ee5258ef30c57d2c7e0917e58

SHA1
9eb705424bb71be04cf0eda9230ebc3c45f3ea69

SHA256
f98776a50836d5e8acfde7028730f91cb49c2b5f42aef1053d433a79c3220144

SHA512
7dba4dcd7aa182c8c639307c45af0a6e5637de85573da2f29f28d0fab55492dcf9e95318a7002c80b4faf33ab1b74af5b393e81eff94b6d0f5f19150ff9b5143

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll

Filesize
15KB

MD5
90c3324ee5258ef30c57d2c7e0917e58

SHA1
9eb705424bb71be04cf0eda9230ebc3c45f3ea69

SHA256
f98776a50836d5e8acfde7028730f91cb49c2b5f42aef1053d433a79c3220144

SHA512
7dba4dcd7aa182c8c639307c45af0a6e5637de85573da2f29f28d0fab55492dcf9e95318a7002c80b4faf33ab1b74af5b393e81eff94b6d0f5f19150ff9b5143

Download Submit
memory/1508-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1508-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1508-56-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1508-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1652-60-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1652-62-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1652-64-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1860-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads