7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39

General

Target

7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
Size

362KB
MD5

cf85a96d6344658758b801115ccaa068
SHA1

22f49ae85f22cb7e34d28b1ab89e089d8b9873fc
SHA256

7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39
SHA512

61085d6eda381ddce479dd95286e40366f9568f8c743e146b56aeb32fbd445abb47bfb22cea7455a650a2bb50b4775727ea4e184de93e7f8caa273ef7ba8fb3f
SSDEEP

6144:hYs3FjduLKLo3OgErEJcsRxiKcD1inUPMORkjMeFE:hLduLYo3OggEJchBwSMOHuE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1444	E1vEhMovKGtEB09M.exe
1528	E1vEhMovKGtEB09M.exe

Deletes itself 1 IoCs

pid	Process
1528	E1vEhMovKGtEB09M.exe

Loads dropped DLL 4 IoCs

pid	Process
1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
1528	E1vEhMovKGtEB09M.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y5zcwVyMNR9 = "C:\\ProgramData\\cO66GPapo\\E1vEhMovKGtEB09M.exe"	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 1444 set thread context of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1528 set thread context of 1460	1528	E1vEhMovKGtEB09M.exe	31

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 308 wrote to memory of 1664	308	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	28
PID 1664 wrote to memory of 1444	1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	29
PID 1664 wrote to memory of 1444	1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	29
PID 1664 wrote to memory of 1444	1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	29
PID 1664 wrote to memory of 1444	1664	7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe	29
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1444 wrote to memory of 1528	1444	E1vEhMovKGtEB09M.exe	30
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31
PID 1528 wrote to memory of 1460	1528	E1vEhMovKGtEB09M.exe	31

C:\Users\Admin\AppData\Local\Temp\7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
"C:\Users\Admin\AppData\Local\Temp\7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe
  "C:\Users\Admin\AppData\Local\Temp\7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe
    "C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe
      "C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe" /i:1528
        5⤵
        
        PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
C:\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
\ProgramData\cO66GPapo\E1vEhMovKGtEB09M.exe

Filesize
362KB

MD5
cf85a96d6344658758b801115ccaa068

SHA1
22f49ae85f22cb7e34d28b1ab89e089d8b9873fc

SHA256
7ffc8893f47d84a64b95b7e6757c264f56452668cd28dc0018bcce8aab0bfc39

SHA512
61085d6eda381ddce479dd95286e40366f9568f8c743e146b56aeb32fbd445abb47bfb22cea7455a650a2bb50b4775727ea4e184de93e7f8caa273ef7ba8fb3f

Download Submit
\Users\Admin\AppData\Local\Temp\IZrNfZVIq.exe

Filesize
362KB

MD5
8f9c1bb4e710880fe96be7e81a1de6dd

SHA1
89be098ab368fe6e56b69c57bbe226c56d3f3058

SHA256
e5fe2d36fbf8fae8393ab0ae83d94d6c4da4c8b079154b9e65e49e73f4c4da76

SHA512
c0afb0eba062db2ff437a358883af4333b5395b8dd3ad85fc429bd8c82a5acd46e93e6488c4119a15c393ca51e6b6cc70c74ee9f42ccc56ab9c425c9ca364a19

Download Submit
memory/1444-64-0x0000000000000000-mapping.dmp

Download
memory/1460-86-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1460-85-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1460-81-0x00000000004475D4-mapping.dmp

Download
memory/1528-75-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1528-84-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1528-77-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1528-71-0x00000000004475D4-mapping.dmp

Download
memory/1664-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1664-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1664-57-0x00000000004475D4-mapping.dmp

Download
memory/1664-66-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1664-61-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1664-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1664-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing