3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1

General

Target

3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
Size

1.1MB
MD5

b7c6113e4c4cff9c2981235815074780
SHA1

2b4c515894be43b40b4e09cdf1b56e46a83d7278
SHA256

3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1
SHA512

1a5f2623f0eaba82591e42a8bc2e8ccafa3604830ecf92584dadbeba62e27d983337f871212d5143ea754281843c861750e1d29f8bdf54607e5c0e70d9a2d927
SSDEEP

12288:p7g75OSQVvVRUg4hFkSqnZQF+lluGWt8XIsdmYqedvxShA1T3DXAw8:utWvVRUzhOdKF+llj6w8JedvlT3Do

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1900	eHOASZUXkFgKh.exe
1160	eHOASZUXkFgKh.exe

Deletes itself 1 IoCs

pid	Process
1160	eHOASZUXkFgKh.exe

Loads dropped DLL 4 IoCs

pid	Process
1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
1160	eHOASZUXkFgKh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\k4FGVi0ZEi = "C:\\ProgramData\\YEqPcLh3Pbr\\eHOASZUXkFgKh.exe"	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1900 set thread context of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1160 set thread context of 2024	1160	eHOASZUXkFgKh.exe	30

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1652 wrote to memory of 1144	1652	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	27
PID 1144 wrote to memory of 1900	1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	28
PID 1144 wrote to memory of 1900	1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	28
PID 1144 wrote to memory of 1900	1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	28
PID 1144 wrote to memory of 1900	1144	3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe	28
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1900 wrote to memory of 1160	1900	eHOASZUXkFgKh.exe	29
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30
PID 1160 wrote to memory of 2024	1160	eHOASZUXkFgKh.exe	30

C:\Users\Admin\AppData\Local\Temp\3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
"C:\Users\Admin\AppData\Local\Temp\3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe
  "C:\Users\Admin\AppData\Local\Temp\3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe
    "C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe
      "C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe" /i:1160
        5⤵
        
        PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
C:\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
\ProgramData\YEqPcLh3Pbr\eHOASZUXkFgKh.exe

Filesize
1.1MB

MD5
b7c6113e4c4cff9c2981235815074780

SHA1
2b4c515894be43b40b4e09cdf1b56e46a83d7278

SHA256
3725c24d8e1697c02d0cb543c5caf7aa26078d6ba022944b061e22847dcefbf1

SHA512
1a5f2623f0eaba82591e42a8bc2e8ccafa3604830ecf92584dadbeba62e27d983337f871212d5143ea754281843c861750e1d29f8bdf54607e5c0e70d9a2d927

Download Submit
\Users\Admin\AppData\Local\Temp\m1atZM3g.exe

Filesize
1.1MB

MD5
c699d06c3989aaa348418dbf6dfceec8

SHA1
135e1c57e4a5083f3faa8f0f6a6e4f2de7c8cb09

SHA256
040ead9595c491aad994549a95fea8baba058fff670b144fe5103fc188b2a83b

SHA512
51261c0a9844bd10da1156651da39518f3fdcbd6617811cfb5962ef55f6db7d18f052099798cae61682a5bb4e68bd58b3333b4bec8d5d24ff91a210161711112

Download Submit
memory/1144-60-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1144-62-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1144-57-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1144-55-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1144-66-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1144-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1160-78-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1160-85-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1652-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/2024-86-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2024-87-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing