a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190

General

Target

a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
Size

2.0MB
MD5

5d7be0e0f5c6010bb2d73d774010e0df
SHA1

b848c596ece988bfb0435ff667dc394c17f70300
SHA256

a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190
SHA512

65446afd574dd93a9a3e1390b31edfb871f7f5684b07e8488375225870e1da37e58a29ad2a561f169df6b1dc215bd35fd86e2b9c4cca57f22628a9ab10efce29
SSDEEP

49152:U6hv9W/ug/057LLqs3YvNa6khzoEPyKi6:U096s5jqEYF5khcEP1F

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	303365~1.EXE

Loads dropped DLL 5 IoCs

pid	Process
900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
1992	303365~1.EXE
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 900 wrote to memory of 1992	900	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	27
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28
PID 1992 wrote to memory of 940	1992	303365~1.EXE	28

C:\Users\Admin\AppData\Local\Temp\a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
"C:\Users\Admin\AppData\Local\Temp\a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 268
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1992-64-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing