a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623

General

Target

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
Size

224KB
MD5

5f36d6c3ca325874af64350a4a8ca699
SHA1

fc5250b3aa0809fe4fc27dcd5e72a6f8b751673c
SHA256

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623
SHA512

a842b8c8a51bb867bb0cadd170df234e311e361f4eb17780d4418299af20d166a4a7b0ffcf072dfb1012147435459562c2b2271edb72b11fac6dca1cf0923d16
SSDEEP

6144:frWoO2IKJ7Uk3JvegqMHIlEO+RXA4YIwn:iotRgUJvegDAV+l6Iwn

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

steamwebhelper.exe

pid process

324 steamwebhelper.exe
Loads dropped DLL 1 IoCs

Processes:

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe

pid process

1328 a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe

pid	process
324	steamwebhelper.exe

pid	process
1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exesteamwebhelper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exesteamwebhelper.exe

pid process

1328 a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
324 steamwebhelper.exe

pid	process
1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
324	steamwebhelper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exesteamwebhelper.exe

description	pid	process
Token: SeDebugPrivilege	1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
Token: SeDebugPrivilege	324	steamwebhelper.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe

description	pid	process	target process
PID 1328 wrote to memory of 324	1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe	steamwebhelper.exe
PID 1328 wrote to memory of 324	1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe	steamwebhelper.exe
PID 1328 wrote to memory of 324	1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe	steamwebhelper.exe
PID 1328 wrote to memory of 324	1328	a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe	steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe
"C:\Users\Admin\AppData\Local\Temp\a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
"C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
224KB

MD5
5f36d6c3ca325874af64350a4a8ca699

SHA1
fc5250b3aa0809fe4fc27dcd5e72a6f8b751673c

SHA256
a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623

SHA512
a842b8c8a51bb867bb0cadd170df234e311e361f4eb17780d4418299af20d166a4a7b0ffcf072dfb1012147435459562c2b2271edb72b11fac6dca1cf0923d16

Download Submit
C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
224KB

MD5
5f36d6c3ca325874af64350a4a8ca699

SHA1
fc5250b3aa0809fe4fc27dcd5e72a6f8b751673c

SHA256
a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623

SHA512
a842b8c8a51bb867bb0cadd170df234e311e361f4eb17780d4418299af20d166a4a7b0ffcf072dfb1012147435459562c2b2271edb72b11fac6dca1cf0923d16

Download Submit
\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
Filesize
224KB

MD5
5f36d6c3ca325874af64350a4a8ca699

SHA1
fc5250b3aa0809fe4fc27dcd5e72a6f8b751673c

SHA256
a50b5c82f9725549a6c4cd0fd781b1a734961ddfc71cd9dac7ff0a83bffcd623

SHA512
a842b8c8a51bb867bb0cadd170df234e311e361f4eb17780d4418299af20d166a4a7b0ffcf072dfb1012147435459562c2b2271edb72b11fac6dca1cf0923d16

Download Submit
memory/324-59-0x0000000000000000-mapping.dmp

Download
memory/324-62-0x00000000002B0000-0x00000000002EE000-memory.dmp

Filesize
248KB

Download
memory/1328-54-0x0000000000FF0000-0x000000000102E000-memory.dmp

Filesize
248KB

Download
memory/1328-55-0x0000000000440000-0x0000000000478000-memory.dmp

Filesize
224KB

Download
memory/1328-56-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/1328-57-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads