b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59

General

Target

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
Size

178KB
MD5

37486e8286684ec19f8967b257d2ccf6
SHA1

b80b9703783f74253c9c87081ce630f6b84e40ba
SHA256

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59
SHA512

bda33e80ced874c0281cdfc658214a5d0ccb1f1247876b0da3afdd6f6c3664300d9939a36698df093f5c1bd2d6fd5ffbbd4a73b888c9fdb43cc87f6a42b1ea81
SSDEEP

3072:lm1FRLpe2ltbhH5CiB4MhWXsL2RKvSBdAXy:cvRNe2ltCQhWXsGKkf

Score

7^/10

persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Windows\\System32\\aaaaaaaa.exe"	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Users\\Admin\\aaaaaaaa.exe"	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Drops file in System32 directory 1 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description ioc process

File created C:\Windows\SysWOW64\aaaaaaaa.exe b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	ioc	process
File created	C:\Windows\SysWOW64\aaaaaaaa.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exeb2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	pid	process	target process
PID 4640 set thread context of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1560 set thread context of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

pid	process
4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exeb2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe

description	pid	process	target process
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 4640 wrote to memory of 1560	4640	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe
PID 1560 wrote to memory of 1852	1560	b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
"C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe
"C:\Users\Admin\AppData\Local\Temp\b2216689bc98c78464ecd32132fbeb267084fdbbdef5c23ce06bc35b18564a59.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:1852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-132-0x0000000000000000-mapping.dmp

Download
memory/1560-133-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/1560-136-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/1560-139-0x0000000013100000-0x000000001310A000-memory.dmp

Filesize
40KB

Download
memory/1852-138-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1852-137-0x0000000000000000-mapping.dmp

Download
memory/1852-141-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1852-142-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/4640-134-0x00000000005B0000-0x00000000005B5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads