44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835

General

Target

44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
Size

288KB
MD5

54c32d7aabf7f8dcd6ed16cc8147fd12
SHA1

5c4c219891f88c94b36fce3e696fc3d9b1680e80
SHA256

44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835
SHA512

c9f0ba812f0d2153c5f124d3bb2ab913fc775813db2c2acd86515f09d991c865d956e31512defeb93e0e6d514d8c92ed21668d88d355f68f6ca02172848fa44b
SSDEEP

6144:Gbu9uj8Pw2rZqabNzSPR4ZeY5VuiDjMsOxp6+vfUVMwT:Yu9oL2gONuJ4xDCxp6+vfm

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

tara.exetara.exe

pid process

2204 tara.exe
3504 tara.exe

pid	process
2204	tara.exe
3504	tara.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tara.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	tara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uxidok\\tara.exe"	tara.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exetara.exe

description	pid	process	target process
PID 2548 set thread context of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2204 set thread context of 3504	2204	tara.exe	tara.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exetara.exe

pid	process
4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe
3504	tara.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exetara.exetara.exe

description	pid	process	target process
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 2548 wrote to memory of 4852	2548	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
PID 4852 wrote to memory of 2204	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	tara.exe
PID 4852 wrote to memory of 2204	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	tara.exe
PID 4852 wrote to memory of 2204	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 2204 wrote to memory of 3504	2204	tara.exe	tara.exe
PID 3504 wrote to memory of 2444	3504	tara.exe	sihost.exe
PID 3504 wrote to memory of 2444	3504	tara.exe	sihost.exe
PID 3504 wrote to memory of 2444	3504	tara.exe	sihost.exe
PID 3504 wrote to memory of 2444	3504	tara.exe	sihost.exe
PID 3504 wrote to memory of 2444	3504	tara.exe	sihost.exe
PID 3504 wrote to memory of 2460	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 2460	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 2460	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 2460	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 2460	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 2652	3504	tara.exe	taskhostw.exe
PID 3504 wrote to memory of 2652	3504	tara.exe	taskhostw.exe
PID 3504 wrote to memory of 2652	3504	tara.exe	taskhostw.exe
PID 3504 wrote to memory of 2652	3504	tara.exe	taskhostw.exe
PID 3504 wrote to memory of 2652	3504	tara.exe	taskhostw.exe
PID 3504 wrote to memory of 3060	3504	tara.exe	Explorer.EXE
PID 3504 wrote to memory of 3060	3504	tara.exe	Explorer.EXE
PID 3504 wrote to memory of 3060	3504	tara.exe	Explorer.EXE
PID 3504 wrote to memory of 3060	3504	tara.exe	Explorer.EXE
PID 3504 wrote to memory of 3060	3504	tara.exe	Explorer.EXE
PID 3504 wrote to memory of 756	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 756	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 756	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 756	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 756	3504	tara.exe	svchost.exe
PID 3504 wrote to memory of 3236	3504	tara.exe	DllHost.exe
PID 3504 wrote to memory of 3236	3504	tara.exe	DllHost.exe
PID 3504 wrote to memory of 3236	3504	tara.exe	DllHost.exe
PID 3504 wrote to memory of 3236	3504	tara.exe	DllHost.exe
PID 3504 wrote to memory of 3236	3504	tara.exe	DllHost.exe
PID 4852 wrote to memory of 1684	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	cmd.exe
PID 4852 wrote to memory of 1684	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	cmd.exe
PID 4852 wrote to memory of 1684	4852	44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe	cmd.exe
PID 3504 wrote to memory of 3328	3504	tara.exe	StartMenuExperienceHost.exe
PID 3504 wrote to memory of 3328	3504	tara.exe	StartMenuExperienceHost.exe
PID 3504 wrote to memory of 3328	3504	tara.exe	StartMenuExperienceHost.exe
PID 3504 wrote to memory of 3328	3504	tara.exe	StartMenuExperienceHost.exe
PID 3504 wrote to memory of 3328	3504	tara.exe	StartMenuExperienceHost.exe
PID 3504 wrote to memory of 3392	3504	tara.exe	RuntimeBroker.exe
PID 3504 wrote to memory of 3392	3504	tara.exe	RuntimeBroker.exe
PID 3504 wrote to memory of 3392	3504	tara.exe	RuntimeBroker.exe
PID 3504 wrote to memory of 3392	3504	tara.exe	RuntimeBroker.exe
PID 3504 wrote to memory of 3392	3504	tara.exe	RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3392

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:756

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
"C:\Users\Admin\AppData\Local\Temp\44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe
"C:\Users\Admin\AppData\Local\Temp\44478c730a9eb20469084cc7abdcb20c1a70ca948d55cee9f5056f96f746f835.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852

C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe
"C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe
"C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NPYF173.bat"
4⤵
PID:1684

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:868

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2652

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2460

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NPYF173.bat
Filesize
278B

MD5
bb3fa7a5aec73f29277b574a4c21880c

SHA1
678e1370d741c5cb97ee9549e2f7fdd2c04d606d

SHA256
36ce3940e59b7b54a10775868bb02aaf20e0a060e5a3456deb8922193882966f

SHA512
b57623ab637395a0e3addfa3a8b8c9c140dd818891bd8891b2a164189bffc7bb9ec36b429e7394e79b475a7f9db4e110428be7a6d98f541827bb1c162f73ebf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe
Filesize
288KB

MD5
f612bb367ca853721d1ca0a6434be7bc

SHA1
30e3c1bab728e0154dae2fc9e1a46e58582986e8

SHA256
848178bf77cd7d7b791806317d8ad30256cb50bcf8a2348de435c8a3b6dd4148

SHA512
915c5ad09c120f2d5aeaa443457ae729a7f97a4a6f63f74fe35d1e7ec2ff15307d5c5d80f07159e460afb3a1d5447442173ebb2b788590d5a653c67d600da1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe
Filesize
288KB

MD5
f612bb367ca853721d1ca0a6434be7bc

SHA1
30e3c1bab728e0154dae2fc9e1a46e58582986e8

SHA256
848178bf77cd7d7b791806317d8ad30256cb50bcf8a2348de435c8a3b6dd4148

SHA512
915c5ad09c120f2d5aeaa443457ae729a7f97a4a6f63f74fe35d1e7ec2ff15307d5c5d80f07159e460afb3a1d5447442173ebb2b788590d5a653c67d600da1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uxidok\tara.exe
Filesize
288KB

MD5
f612bb367ca853721d1ca0a6434be7bc

SHA1
30e3c1bab728e0154dae2fc9e1a46e58582986e8

SHA256
848178bf77cd7d7b791806317d8ad30256cb50bcf8a2348de435c8a3b6dd4148

SHA512
915c5ad09c120f2d5aeaa443457ae729a7f97a4a6f63f74fe35d1e7ec2ff15307d5c5d80f07159e460afb3a1d5447442173ebb2b788590d5a653c67d600da1f6

Download Submit
memory/1684-156-0x0000000000E00000-0x0000000000E42000-memory.dmp

Filesize
264KB

Download
memory/1684-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1684-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1684-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1684-149-0x0000000000000000-mapping.dmp

Download
memory/2204-139-0x0000000000000000-mapping.dmp

Download
memory/2204-148-0x0000000001076000-0x0000000001079000-memory.dmp

Filesize
12KB

Download
memory/2204-142-0x0000000001076000-0x000000000107B000-memory.dmp

Filesize
20KB

Download
memory/2204-147-0x0000000074400000-0x00000000749B1000-memory.dmp

Filesize
5.7MB

Download
memory/2548-157-0x0000000074B40000-0x00000000750F1000-memory.dmp

Filesize
5.7MB

Download
memory/2548-135-0x0000000074B40000-0x00000000750F1000-memory.dmp

Filesize
5.7MB

Download
memory/3504-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3504-146-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3504-143-0x0000000000000000-mapping.dmp

Download
memory/3504-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3504-158-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-150-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-138-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-133-0x0000000000000000-mapping.dmp

Download
memory/4852-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads