51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56

General

Target

51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
Size

205KB
MD5

9c11fce9426735b38d65aaab7ac52ac1
SHA1

6681cfcd27aa72f7af69f1800c2d9fd3bb6e0e6e
SHA256

51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56
SHA512

381ca6a177df0222d9f29e8a4078f531c9c249deccba08c8af3d6573507876c086918c59720a4ed287bb864b1bf70ec5b93b1784f81cd66afcc6303454d57f43
SSDEEP

1536:Z2EoFMbYj5ZrIUbJX7+7fHYiJUP0k1A9WPhRkBBABywTmKFwB3r5Icdear:5U9Rb1hsfoTkBBoyUjFwVFI6ea

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winsds4 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds4.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Winsds4 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds4.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe

description	pid	process	target process
PID 1556 set thread context of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe

pid	process
1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

explorer.exe

pid process

4440 explorer.exe

pid	process
4440	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe

description	pid	process	target process
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 1556 wrote to memory of 5060	1556	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe
PID 5060 wrote to memory of 4440	5060	51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
"C:\Users\Admin\AppData\Local\Temp\51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe
  "C:\Users\Admin\AppData\Local\Temp\51b4cf58323ad7ab82b0c6e608f5618bf12c15175224a02666f01062e25f7a56.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: RenamesItself
    PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-136-0x0000000002180000-0x0000000002185000-memory.dmp

Filesize
20KB

Download
memory/4440-137-0x0000000000000000-mapping.dmp

Download
memory/4440-138-0x0000000001260000-0x0000000001264000-memory.dmp

Filesize
16KB

Download
memory/5060-132-0x0000000000000000-mapping.dmp

Download
memory/5060-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5060-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads