81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53

General

Target

81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe
Size

122KB
MD5

a3f2f862d76b717a639cf48cfaa159e3
SHA1

81257db3f852e60f42bce8e82f254e90a989ed21
SHA256

81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53
SHA512

26beaa38eb81e4bbd4096b8efbff17f57d86ac9709ae49a37d50aa789b4d53d30eacaeae6de197fed8991dcfcc6bdaa106e7fad1239695a4c52976699cc6207c
SSDEEP

1536:MXXosVRgm2GkTysXSBfLmWLt077BD96iMW1JbGQ/IRSi9QSXHxThiF6uKeoUCBq:MTbxpB65BZRMCJaEIYi9QS5eoUCBq

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2612	netprotocol.exe
1164	netprotocol.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 2612 set thread context of 1164	2612	netprotocol.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4264	4644	WerFault.exe	67
3368	2612	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 4644 wrote to memory of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 4644 wrote to memory of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 4644 wrote to memory of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 4644 wrote to memory of 1636	4644	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	82
PID 1636 wrote to memory of 2612	1636	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	84
PID 1636 wrote to memory of 2612	1636	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	84
PID 1636 wrote to memory of 2612	1636	81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe	84
PID 2612 wrote to memory of 1164	2612	netprotocol.exe	86
PID 2612 wrote to memory of 1164	2612	netprotocol.exe	86
PID 2612 wrote to memory of 1164	2612	netprotocol.exe	86
PID 2612 wrote to memory of 1164	2612	netprotocol.exe	86
PID 2612 wrote to memory of 1164	2612	netprotocol.exe	86

C:\Users\Admin\AppData\Local\Temp\81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe
"C:\Users\Admin\AppData\Local\Temp\81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe
  C:\Users\Admin\AppData\Local\Temp\81b80371e4d43b28f987e6aba242b08175cf4ffea8038d28df97c15b66967d53.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:1164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 296
      4⤵
      Program crash
      PID:3368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 296
  2⤵
  - Program crash
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4644 -ip 4644
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2612 -ip 2612
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
122KB

MD5
d15f4d79302a0033cffe43373ed96416

SHA1
ff0fb3b31eb1970282349c798bc34e4d2b830e27

SHA256
21b8e01e20e98107a2ac73a8ecc53c05b1a3589718892708f7d1eb44f4616b60

SHA512
5adf4e24bda839a91c0aca80883ee5a0f40232494dd9045d909266da9d610f87645bc2f21879a02521010ecfa41c00b0c5f6358cb7559e069e38f8d87730663d

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
122KB

MD5
d15f4d79302a0033cffe43373ed96416

SHA1
ff0fb3b31eb1970282349c798bc34e4d2b830e27

SHA256
21b8e01e20e98107a2ac73a8ecc53c05b1a3589718892708f7d1eb44f4616b60

SHA512
5adf4e24bda839a91c0aca80883ee5a0f40232494dd9045d909266da9d610f87645bc2f21879a02521010ecfa41c00b0c5f6358cb7559e069e38f8d87730663d

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
122KB

MD5
d15f4d79302a0033cffe43373ed96416

SHA1
ff0fb3b31eb1970282349c798bc34e4d2b830e27

SHA256
21b8e01e20e98107a2ac73a8ecc53c05b1a3589718892708f7d1eb44f4616b60

SHA512
5adf4e24bda839a91c0aca80883ee5a0f40232494dd9045d909266da9d610f87645bc2f21879a02521010ecfa41c00b0c5f6358cb7559e069e38f8d87730663d

Download Submit
memory/1164-143-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1164-142-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1164-146-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1636-135-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1636-133-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1636-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1636-144-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1636-145-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing