6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a

General

Target

6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
Size

501KB
MD5

25983e6283964d0b6ef1e1025d0a82b2
SHA1

083bc8f79f85741dd3df0aa4b41730bdbf0a58ff
SHA256

6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a
SHA512

2d12e2595c72cd6ce9a088824acd3aa6e66a450bc4d0777b3e285d00151d97cf29beab89e0eb49966bde595fd7e2e52e93d858c9ece5ec33d3a2cdd0b65106e6
SSDEEP

6144:pdNszUtPwxSm/yHj4jwoHW+srKkoU1dxoiHfZYHU5Q1p:p6VEm/Oa6KkT1dqOfyn1p

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4852	bJCXnyez8.exe
508	bJCXnyez8.exe

Loads dropped DLL 4 IoCs

pid	Process
4840	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
4840	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
508	bJCXnyez8.exe
508	bJCXnyez8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lUdc5gsAgxXcEUkV = "C:\\ProgramData\\PspzAqBVMBfCAfe\\bJCXnyez8.exe"	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4852 set thread context of 508	4852	bJCXnyez8.exe	85
PID 508 set thread context of 1208	508	bJCXnyez8.exe	87

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4636 wrote to memory of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4636 wrote to memory of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4636 wrote to memory of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4636 wrote to memory of 4840	4636	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	83
PID 4840 wrote to memory of 4852	4840	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	84
PID 4840 wrote to memory of 4852	4840	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	84
PID 4840 wrote to memory of 4852	4840	6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe	84
PID 4852 wrote to memory of 508	4852	bJCXnyez8.exe	85
PID 4852 wrote to memory of 508	4852	bJCXnyez8.exe	85
PID 4852 wrote to memory of 508	4852	bJCXnyez8.exe	85
PID 4852 wrote to memory of 508	4852	bJCXnyez8.exe	85
PID 4852 wrote to memory of 508	4852	bJCXnyez8.exe	85
PID 508 wrote to memory of 1208	508	bJCXnyez8.exe	87
PID 508 wrote to memory of 1208	508	bJCXnyez8.exe	87
PID 508 wrote to memory of 1208	508	bJCXnyez8.exe	87
PID 508 wrote to memory of 1208	508	bJCXnyez8.exe	87
PID 508 wrote to memory of 1208	508	bJCXnyez8.exe	87

C:\Users\Admin\AppData\Local\Temp\6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
"C:\Users\Admin\AppData\Local\Temp\6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe
  "C:\Users\Admin\AppData\Local\Temp\6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe
    "C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe
      "C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:508
    - - C:\Program Files (x86)\Windows Mail\wab.exe
        
        "C:\Program Files (x86)\Windows Mail\wab.exe" /i:508
        5⤵
        
        PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe

Filesize
501KB

MD5
25983e6283964d0b6ef1e1025d0a82b2

SHA1
083bc8f79f85741dd3df0aa4b41730bdbf0a58ff

SHA256
6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a

SHA512
2d12e2595c72cd6ce9a088824acd3aa6e66a450bc4d0777b3e285d00151d97cf29beab89e0eb49966bde595fd7e2e52e93d858c9ece5ec33d3a2cdd0b65106e6

Download Submit
C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe

Filesize
501KB

MD5
25983e6283964d0b6ef1e1025d0a82b2

SHA1
083bc8f79f85741dd3df0aa4b41730bdbf0a58ff

SHA256
6c8bfec9206ae986edc65d58c08abd310ef4ab15e49d0633fc042712a46eb21a

SHA512
2d12e2595c72cd6ce9a088824acd3aa6e66a450bc4d0777b3e285d00151d97cf29beab89e0eb49966bde595fd7e2e52e93d858c9ece5ec33d3a2cdd0b65106e6

Download Submit
C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe

Filesize
501KB

MD5
f939bb0ec326cafe63b96d81248bbb53

SHA1
bf98de99f42eda08a2f3d67e651eeb8277000c7b

SHA256
bba24c8e19dd81ca9700974a56a96aa997030fcfedd6a42fb3b6b4b6e27b9bc6

SHA512
6d38ec59eacc87a257b8cadd6aed4d5fd827d704b3e17bdb1fd90cd00f2e59b065fc78ed8b2277705c2daca8ee2d3a31d11c456af950f6da24f88fe09fd7a900

Download Submit
C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe

Filesize
501KB

MD5
f939bb0ec326cafe63b96d81248bbb53

SHA1
bf98de99f42eda08a2f3d67e651eeb8277000c7b

SHA256
bba24c8e19dd81ca9700974a56a96aa997030fcfedd6a42fb3b6b4b6e27b9bc6

SHA512
6d38ec59eacc87a257b8cadd6aed4d5fd827d704b3e17bdb1fd90cd00f2e59b065fc78ed8b2277705c2daca8ee2d3a31d11c456af950f6da24f88fe09fd7a900

Download Submit
C:\ProgramData\PspzAqBVMBfCAfe\bJCXnyez8.exe

Filesize
501KB

MD5
f939bb0ec326cafe63b96d81248bbb53

SHA1
bf98de99f42eda08a2f3d67e651eeb8277000c7b

SHA256
bba24c8e19dd81ca9700974a56a96aa997030fcfedd6a42fb3b6b4b6e27b9bc6

SHA512
6d38ec59eacc87a257b8cadd6aed4d5fd827d704b3e17bdb1fd90cd00f2e59b065fc78ed8b2277705c2daca8ee2d3a31d11c456af950f6da24f88fe09fd7a900

Download Submit
C:\Users\Admin\AppData\Local\Temp\zPx7jsObC2M4U.exe

Filesize
501KB

MD5
f939bb0ec326cafe63b96d81248bbb53

SHA1
bf98de99f42eda08a2f3d67e651eeb8277000c7b

SHA256
bba24c8e19dd81ca9700974a56a96aa997030fcfedd6a42fb3b6b4b6e27b9bc6

SHA512
6d38ec59eacc87a257b8cadd6aed4d5fd827d704b3e17bdb1fd90cd00f2e59b065fc78ed8b2277705c2daca8ee2d3a31d11c456af950f6da24f88fe09fd7a900

Download Submit
C:\Users\Admin\AppData\Local\Temp\zPx7jsObC2M4U.exe

Filesize
501KB

MD5
f939bb0ec326cafe63b96d81248bbb53

SHA1
bf98de99f42eda08a2f3d67e651eeb8277000c7b

SHA256
bba24c8e19dd81ca9700974a56a96aa997030fcfedd6a42fb3b6b4b6e27b9bc6

SHA512
6d38ec59eacc87a257b8cadd6aed4d5fd827d704b3e17bdb1fd90cd00f2e59b065fc78ed8b2277705c2daca8ee2d3a31d11c456af950f6da24f88fe09fd7a900

Download Submit
memory/508-151-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/508-157-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/508-148-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1208-156-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1208-158-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4840-141-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4840-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4840-135-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4840-136-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4840-133-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing