e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36

General

Target

e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
Size

356KB
MD5

16992477af6c1128ccf8e2bb7d41b165
SHA1

f0a8f7bc308ee177dd83df0f573a2ea6654be847
SHA256

e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36
SHA512

9cb37d03753d1ccdaaf9952d64b1d6ec671e86d509e77e48137d13ea4afad452c7a413e7fc1d9231da253198e7d7d5756c702ebe176be9d7de276ba946a42117
SSDEEP

6144:7vbx8OOArW84uuJTVZS0EMja2G6dJfoWSXlAiETbld6stREj:7LO2dsFjc6Q7GlFRs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
632	oruMjVtixyxbO.exe
4988	oruMjVtixyxbO.exe

Loads dropped DLL 4 IoCs

pid	Process
2948	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
2948	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
4988	oruMjVtixyxbO.exe
4988	oruMjVtixyxbO.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zWMJwyXfyPo = "C:\\ProgramData\\feWYB6iekveAOjU8\\oruMjVtixyxbO.exe"	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 632 set thread context of 4988	632	oruMjVtixyxbO.exe	86

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 2472 wrote to memory of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 2472 wrote to memory of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 2472 wrote to memory of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 2472 wrote to memory of 2948	2472	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	83
PID 2948 wrote to memory of 632	2948	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	85
PID 2948 wrote to memory of 632	2948	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	85
PID 2948 wrote to memory of 632	2948	e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe	85
PID 632 wrote to memory of 4988	632	oruMjVtixyxbO.exe	86
PID 632 wrote to memory of 4988	632	oruMjVtixyxbO.exe	86
PID 632 wrote to memory of 4988	632	oruMjVtixyxbO.exe	86
PID 632 wrote to memory of 4988	632	oruMjVtixyxbO.exe	86
PID 632 wrote to memory of 4988	632	oruMjVtixyxbO.exe	86

C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
"C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
  "C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe
    "C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe
      "C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe

Filesize
356KB

MD5
16992477af6c1128ccf8e2bb7d41b165

SHA1
f0a8f7bc308ee177dd83df0f573a2ea6654be847

SHA256
e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36

SHA512
9cb37d03753d1ccdaaf9952d64b1d6ec671e86d509e77e48137d13ea4afad452c7a413e7fc1d9231da253198e7d7d5756c702ebe176be9d7de276ba946a42117

Download Submit
C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe

Filesize
356KB

MD5
16992477af6c1128ccf8e2bb7d41b165

SHA1
f0a8f7bc308ee177dd83df0f573a2ea6654be847

SHA256
e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36

SHA512
9cb37d03753d1ccdaaf9952d64b1d6ec671e86d509e77e48137d13ea4afad452c7a413e7fc1d9231da253198e7d7d5756c702ebe176be9d7de276ba946a42117

Download Submit
C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe

Filesize
356KB

MD5
d8f215c272b6e002b80aab81d8d396a6

SHA1
310bb317cb5b73ea4a7e2a5d3c902314edaf58dc

SHA256
7c2c4448c50d8266f6331fbade573471582ebceff6a5234516cf37cd67d65260

SHA512
e54979a007b4f10b1153d288d829f77c80be8430684de42d87058b22f2fec0eee1af4eddd9d742d2a0ef836ecb0d96cf81400552a22efc68ccb352af1feda584

Download Submit
C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe

Filesize
356KB

MD5
d8f215c272b6e002b80aab81d8d396a6

SHA1
310bb317cb5b73ea4a7e2a5d3c902314edaf58dc

SHA256
7c2c4448c50d8266f6331fbade573471582ebceff6a5234516cf37cd67d65260

SHA512
e54979a007b4f10b1153d288d829f77c80be8430684de42d87058b22f2fec0eee1af4eddd9d742d2a0ef836ecb0d96cf81400552a22efc68ccb352af1feda584

Download Submit
C:\ProgramData\feWYB6iekveAOjU8\oruMjVtixyxbO.exe

Filesize
356KB

MD5
d8f215c272b6e002b80aab81d8d396a6

SHA1
310bb317cb5b73ea4a7e2a5d3c902314edaf58dc

SHA256
7c2c4448c50d8266f6331fbade573471582ebceff6a5234516cf37cd67d65260

SHA512
e54979a007b4f10b1153d288d829f77c80be8430684de42d87058b22f2fec0eee1af4eddd9d742d2a0ef836ecb0d96cf81400552a22efc68ccb352af1feda584

Download Submit
C:\Users\Admin\AppData\Local\Temp\jMkVLey7363E4.exe

Filesize
356KB

MD5
d8f215c272b6e002b80aab81d8d396a6

SHA1
310bb317cb5b73ea4a7e2a5d3c902314edaf58dc

SHA256
7c2c4448c50d8266f6331fbade573471582ebceff6a5234516cf37cd67d65260

SHA512
e54979a007b4f10b1153d288d829f77c80be8430684de42d87058b22f2fec0eee1af4eddd9d742d2a0ef836ecb0d96cf81400552a22efc68ccb352af1feda584

Download Submit
C:\Users\Admin\AppData\Local\Temp\jMkVLey7363E4.exe

Filesize
356KB

MD5
d8f215c272b6e002b80aab81d8d396a6

SHA1
310bb317cb5b73ea4a7e2a5d3c902314edaf58dc

SHA256
7c2c4448c50d8266f6331fbade573471582ebceff6a5234516cf37cd67d65260

SHA512
e54979a007b4f10b1153d288d829f77c80be8430684de42d87058b22f2fec0eee1af4eddd9d742d2a0ef836ecb0d96cf81400552a22efc68ccb352af1feda584

Download Submit
memory/2948-139-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2948-143-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2948-138-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2948-135-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2948-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2948-133-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4988-149-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4988-150-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing