b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557

General

Target

b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Size

515KB
MD5

aeed651f979e942281e73a08181fbdc4
SHA1

987f17265a289ac9172b1111f3e65b01c05fbc11
SHA256

b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557
SHA512

0f789130004cb4d74bc03d6729924b141cc6c570ed84b15e4d43d60570c153930de1348e37a86db6d8f6efb7b9bd830e823cdfc4d886dec6f9fe72292993271e
SSDEEP

12288:UJjPtlxWzYE6mFoC2Lg+WYeg5lqoswkC+kwr:UJBlczY5C2Lg+5eg5lJsrkw

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinLogon	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinLogon = "C:\\Users\\Admin\\Local Settings\\Application Data\\winlogon.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM = "C:\\Users\\Admin\\Local Settings\\Application Data\\dllhost.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe

Executes dropped EXE 1 IoCs

pid	Process
1968	dllhst3g.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Task Scheduler	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Task Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\mstinit.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsm service	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsm service = "C:\\Windows\\lsm.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lsm.exe	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
File opened for modification	C:\Windows\RCX9B1D.tmp	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\Windows\\dllhost.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\DllHost3g = "C:\\ProgramData\\dllhst3g.exe"	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\DllHost3g	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 1968	3560	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe	82
PID 3560 wrote to memory of 1968	3560	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe	82
PID 3560 wrote to memory of 1968	3560	b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe	82

C:\Users\Admin\AppData\Local\Temp\b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe
"C:\Users\Admin\AppData\Local\Temp\b3da5d0851dc3eb600802b2cf5ae4689aaec1cfd321e4ea335fc3fe2fcc6c557.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3560
- C:\ProgramData\dllhst3g.exe
  C:\ProgramData\dllhst3g.exe /a 1
  2⤵
  - Executes dropped EXE
  PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\dllhst3g.exe

Filesize
515KB

MD5
1696e761bf9ca167e709708b03d70c94

SHA1
be7967dcb87daa6a9d338de09753399f4d10ba8a

SHA256
c8f404e89cf82e8ce1c4a7bf5bce6af608bc31afb300c55c6e93f019e6c544d8

SHA512
39a1d0cd242ccf6b2b625a5039278b398d507dec0eb74a22e6915abd8390086de00eb90956acdbb99cfc5b24d11d1e4b095bed772e3c963b86a1dd5e49a44b9b

Download Submit
C:\ProgramData\dllhst3g.exe

Filesize
515KB

MD5
1696e761bf9ca167e709708b03d70c94

SHA1
be7967dcb87daa6a9d338de09753399f4d10ba8a

SHA256
c8f404e89cf82e8ce1c4a7bf5bce6af608bc31afb300c55c6e93f019e6c544d8

SHA512
39a1d0cd242ccf6b2b625a5039278b398d507dec0eb74a22e6915abd8390086de00eb90956acdbb99cfc5b24d11d1e4b095bed772e3c963b86a1dd5e49a44b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx

Filesize
10B

MD5
a6ef3e198c08cfcd11cc26e14c2e0179

SHA1
66b0ebf5b291a318cb9d43d20cd332d9f196d8fa

SHA256
81c8956e192b6e85ac0e16a384de8a9fe470dfd4db47680799c796913a3dc946

SHA512
28e32295dbc608722dd95fe142f38f352df5b5f52fc396f90f41266cfd2d6a4875f117530aa78616b365b57f3c0838b140cf870c52e47a608aef7d1407ff9c8d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads