0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

General

Target

0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Size

981KB
MD5

6c7bb74133fa4462f030de13415108d1
SHA1

61f2bc88935451f0525ccd9e2dba7ff00a3f641b
SHA256

0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b
SHA512

534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1
SSDEEP

12288:rVTvRaeKGlHiM4lKD13YxWnVZunCAEJYQHxw88o8786sfRJ/kkkkckkkkbkkkhkh:tvbvlZVRhnbVAEa1YfJi

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\M-50507564324649683503740\winsvc.exe = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe:*:Enabled:Microsoft Windows Service"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Executes dropped EXE 2 IoCs

pid	Process
2000	winsvc.exe
1284	winsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 820	2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	27
PID 2000 set thread context of 1284	2000	winsvc.exe	29

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-50507564324649683503740\winsvc.exe	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
File opened for modification	C:\Windows\M-50507564324649683503740\winsvc.exe	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
File opened for modification	C:\Windows\M-50507564324649683503740	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
2000	winsvc.exe
2000	winsvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 820	2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	27
PID 2012 wrote to memory of 820	2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	27
PID 2012 wrote to memory of 820	2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	27
PID 2012 wrote to memory of 820	2012	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	27
PID 820 wrote to memory of 2000	820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	28
PID 820 wrote to memory of 2000	820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	28
PID 820 wrote to memory of 2000	820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	28
PID 820 wrote to memory of 2000	820	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	28
PID 2000 wrote to memory of 1284	2000	winsvc.exe	29
PID 2000 wrote to memory of 1284	2000	winsvc.exe	29
PID 2000 wrote to memory of 1284	2000	winsvc.exe	29
PID 2000 wrote to memory of 1284	2000	winsvc.exe	29

C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
"C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
  "C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\M-50507564324649683503740\winsvc.exe
    C:\Windows\M-50507564324649683503740\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\M-50507564324649683503740\winsvc.exe
      C:\Windows\M-50507564324649683503740\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
memory/820-58-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1284-68-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2012-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2012-57-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads