c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf

General

Target

c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe
Size

124KB
MD5

6318ca8be2bd7cff4b9581ce6b6ecbb4
SHA1

aabadbb60bc3793b135a8013de4fe9bfe20726a8
SHA256

c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf
SHA512

b1bc8b8b4c04c50cfa7f07ba576c73a661fde720f2ec8dc71475166c8b1b27f8a6f3a448e6f5c6acd45c690024fd80314e8b7c0c18cca9baf4648fd049e1d234
SSDEEP

3072:0kW/yn650u4Bb7wTpIa5szgo3SJzPn3d8x+/Jo:nK4Bb7sIa+FCJzPt8xi

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	strident.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bs_stealth.exe"	strident.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	strident.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bs_stealth.exe"	strident.exe

Executes dropped EXE 1 IoCs

pid	Process
220	strident.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Java.exe"	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3428 set thread context of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe
Token: SeDebugPrivilege	220	strident.exe
Token: 33	4468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4468	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
220	strident.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86
PID 3428 wrote to memory of 220	3428	c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe	86

C:\Users\Admin\AppData\Local\Temp\c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe
"C:\Users\Admin\AppData\Local\Temp\c0183be57abd9a16727506a55f03db0dab97478c29333dfad9715fe46ae784bf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\strident.exe
  C:\Users\Admin\AppData\Local\Temp\strident.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\strident.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\strident.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/220-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/220-139-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/220-142-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/220-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3428-132-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/3428-133-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/3428-141-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads