3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d

General

Target

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Size

137KB
MD5

c7fc2aeb7a9f0eb0084b0ca3df713888
SHA1

94f3318cf229abbbbc43f64c92d13a9c74f81373
SHA256

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d
SHA512

e9766fafe25c5a6c4f3ff568c13e1f6fe6ef0c7d4282a268494aa49ee5a597e9acaa48fbe8516bad8228498e27fc09f9b7d66188ed6a4fc37d8afc49028ab449
SSDEEP

3072:ccrSP5z8RCgm730aSEJcp9gH7y8BclYlcAYoruR8:RrSP5oRXm74p9R8BclYlcsrI8

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82MUYSOW-FDIB-S53Y-8G4M-86MMMH5RW3A2}	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82MUYSOW-FDIB-S53Y-8G4M-86MMMH5RW3A2}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe\""	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsLive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	pid	process	target process
PID 1628 set thread context of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

pid process

1628 3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

pid	process
1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	pid	process	target process
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1628 wrote to memory of 848	1628	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
"C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
  "C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-57-0x0000000000401F8F-mapping.dmp

Download
memory/848-59-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/848-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads