b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59

General

Target

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
Size

178KB
MD5

37486e8286684ec19f8967b257d2ccf6
SHA1

b80b9703783f74253c9c87081ce630f6b84e40ba
SHA256

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59
SHA512

bda33e80ced874c0281cdfc658214a5d0ccb1f1247876b0da3afdd6f6c3664300d9939a36698df093f5c1bd2d6fd5ffbbd4a73b888c9fdb43cc87f6a42b1ea81
SSDEEP

3072:lm1FRLpe2ltbhH5CiB4MhWXsL2RKvSBdAXy:cvRNe2ltCQhWXsGKkf

Score

7^/10

persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Windows\\System32\\aaaaaaaa.exe"	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Users\\Admin\\aaaaaaaa.exe"	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Drops file in System32 directory 1 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description ioc process

File created C:\Windows\SysWOW64\aaaaaaaa.exe b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	ioc	process
File created	C:\Windows\SysWOW64\aaaaaaaa.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exeb2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	pid	process	target process
PID 1932 set thread context of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 836 set thread context of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

pid	process
1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exeb2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	pid	process	target process
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1932 wrote to memory of 836	1932	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 836 wrote to memory of 1904	836	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
"C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
"C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-65-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-55-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-54-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-59-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-60-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-61-0x0000000013101CF0-mapping.dmp

Download
memory/836-73-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-64-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/836-57-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/1904-77-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-71-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-72-0x0000000009504E30-mapping.dmp

Download
memory/1904-69-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-67-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-66-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-75-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-76-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1904-70-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1932-62-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads