8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88

General

Target

8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
Size

175KB
MD5

a39f7f890e4aa66827afb5511ec8623b
SHA1

68bc24e244c7ad17aec4bf7d24b5d76c3c54b3b7
SHA256

8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88
SHA512

cba83de2666d8181e58f5362ef7883f07133ab0f586d8e99f80c6915638e0c338af36dfd3baa1bda698279d397efc21c7bbfa777d15d767239767401a5a81ce8
SSDEEP

3072:gBeNJxbKuF7LKpuwFvdNUPnd7FaBXfOX0seK2RKCMHrzIMwY3QLIZO+wC:BJUwL+uWdNid7wBvOXyMfF/J

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff22854f.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff22854f.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff22854 = "C:\\ff22854f\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f22854 = "C:\\ff22854f\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff22854f = "C:\\Users\\Admin\\AppData\\Roaming\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f22854f = "C:\\Users\\Admin\\AppData\\Roaming\\ff22854f.exe"	explorer.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

50 ip-addr.es
56 myexternalip.com

flow	ioc
50	ip-addr.es
56	myexternalip.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe

description	pid	process	target process
PID 4052 set thread context of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exeexplorer.exe

pid process

3952 8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
3180 explorer.exe

pid	process
3952	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
3180	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exeexplorer.exe

C:\Users\Admin\AppData\Local\Temp\8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
"C:\Users\Admin\AppData\Local\Temp\8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
"C:\Users\Admin\AppData\Local\Temp\8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\svchost.exe
-k netsvcs
4⤵
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-140-0x0000000000000000-mapping.dmp

Download
memory/852-141-0x0000000000920000-0x0000000000945000-memory.dmp

Filesize
148KB

Download
memory/3180-137-0x0000000000000000-mapping.dmp

Download
memory/3180-139-0x00000000016F0000-0x0000000001715000-memory.dmp

Filesize
148KB

Download
memory/3952-134-0x0000000000000000-mapping.dmp

Download
memory/3952-136-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3952-138-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4052-132-0x0000000074A90000-0x0000000075041000-memory.dmp

Filesize
5.7MB

Download
memory/4052-133-0x0000000074A90000-0x0000000075041000-memory.dmp

Filesize
5.7MB

Download
memory/4052-135-0x0000000074A90000-0x0000000075041000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 4052 wrote to memory of 3952	4052	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe
PID 3952 wrote to memory of 3180	3952	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	explorer.exe
PID 3952 wrote to memory of 3180	3952	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	explorer.exe
PID 3952 wrote to memory of 3180	3952	8c295763d1f6ae3cd31cefdd354dbe2208d06f5a7bb5f947d6e044da015fdf88.exe	explorer.exe
PID 3180 wrote to memory of 852	3180	explorer.exe	svchost.exe
PID 3180 wrote to memory of 852	3180	explorer.exe	svchost.exe
PID 3180 wrote to memory of 852	3180	explorer.exe	svchost.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads