4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5

General

Target

4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
Size

201KB
MD5

7f6c14418f7e5dd9c105e2fe3c2ebe4f
SHA1

7064226b2316b30b76bbe9c91841600ba6ab3554
SHA256

4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5
SHA512

a70d79a8cfd491f77b1e91efb0b3da009b5d4cc02ebf7ddaff57fa4af94db0c476b72ea5676271c5899f9571e9d7b94514dbe1c626fba24e0f6d271878ba5c48
SSDEEP

1536:WiUDdyis5BP3/Ijy0vt0hkSxDxHs0krH64Osn:Df/IjyBVHs9esn

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Winsds3 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds3.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winsds3 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds3.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe

description	pid	process	target process
PID 5080 set thread context of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe

pid	process
5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

explorer.exe

pid process

4832 explorer.exe

pid	process
4832	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe

description	pid	process	target process
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 5080 wrote to memory of 628	5080	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe
PID 628 wrote to memory of 4832	628	4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
"C:\Users\Admin\AppData\Local\Temp\4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe
"C:\Users\Admin\AppData\Local\Temp\4e995c4532cbe44e5167d3bf2e011e586bd6fa9e9378471a7d98d8f0029197a5.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
3⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:4832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-132-0x0000000000000000-mapping.dmp

Download
memory/628-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/628-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4832-137-0x0000000000000000-mapping.dmp

Download
memory/4832-138-0x00000000001D0000-0x00000000001D4000-memory.dmp

Filesize
16KB

Download
memory/5080-136-0x00000000027E0000-0x00000000027E5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads