3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e

General

Target

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe
Size

77KB
MD5

e041755a7078c81278e2380a6a6b8146
SHA1

d8fa5bbefb9a528e17de07edd366620b381ae21f
SHA256

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e
SHA512

80ca6695b0afc2053ffc108ad4a1328a8d1235d212442248a3e018013ce0563faa84cce2b86af953f3bd70c9af7eb88253bf3876c71a111f103b504b183b99fd
SSDEEP

1536:CuJ2pP1Y54POtO0RcQ0OfJIFnToIfOTvowrvIEuUCi:rJWSPcQ0OfJItTBfkvowrvIEuUCi

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MediaCenter\Parameters\ServiceDll = "C:\\Windows\\system32\\Rlmwtny.cc3"	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

Loads dropped DLL 2 IoCs

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exesvchost.exe

pid process

1396 3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe
1724 svchost.exe
Drops file in System32 directory 1 IoCs

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description ioc process

File created C:\Windows\SysWOW64\Rlmwtny.cc3 3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Rlmwtny.cc3	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exesvchost.exe

pid	process
1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description pid process

Token: SeIncBasePriorityPrivilege 1396 3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe

description	pid	process	target process
PID 1396 wrote to memory of 764	1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe	cmd.exe
PID 1396 wrote to memory of 764	1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe	cmd.exe
PID 1396 wrote to memory of 764	1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe	cmd.exe
PID 1396 wrote to memory of 764	1396	3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe
"C:\Users\Admin\AppData\Local\Temp\3e386640b7f7b6ed53745aa2f62baba6264850911323d249964e43fd6377fb1e.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3E3866~1.EXE > nul
2⤵
PID:764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k start
1⤵
PID:1628

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k start
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\rlmwtny.cc3
Filesize
72KB

MD5
20e7d5677771cb4084e8cc4f2047eab9

SHA1
f9b2bc5d39d2c0a20e394e9ed7a4152b1e651f9b

SHA256
b351a13ab40cdae4f59b4dac037a6d603e8ec941dfcce3caa779228059458a37

SHA512
2625fed86b5fcaaf01baca3db4858b1d34e5a79e4b9b0cf2e1834b9f132d56706e16f3c75a991bbd1eaeb4957418cf903d60a6d9603f501e75077018b94cae13

Download Submit
\Windows\SysWOW64\Rlmwtny.cc3
Filesize
72KB

MD5
20e7d5677771cb4084e8cc4f2047eab9

SHA1
f9b2bc5d39d2c0a20e394e9ed7a4152b1e651f9b

SHA256
b351a13ab40cdae4f59b4dac037a6d603e8ec941dfcce3caa779228059458a37

SHA512
2625fed86b5fcaaf01baca3db4858b1d34e5a79e4b9b0cf2e1834b9f132d56706e16f3c75a991bbd1eaeb4957418cf903d60a6d9603f501e75077018b94cae13

Download Submit
\Windows\SysWOW64\Rlmwtny.cc3
Filesize
72KB

MD5
20e7d5677771cb4084e8cc4f2047eab9

SHA1
f9b2bc5d39d2c0a20e394e9ed7a4152b1e651f9b

SHA256
b351a13ab40cdae4f59b4dac037a6d603e8ec941dfcce3caa779228059458a37

SHA512
2625fed86b5fcaaf01baca3db4858b1d34e5a79e4b9b0cf2e1834b9f132d56706e16f3c75a991bbd1eaeb4957418cf903d60a6d9603f501e75077018b94cae13

Download Submit
memory/764-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads