b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a

General

Target

b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
Size

128KB
MD5

600e0cf619fe61b4a167005d73682315
SHA1

3aba6bfec5a715912d32830d555bd7f18e01ac28
SHA256

b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a
SHA512

e5c49884406060c2ee29a74b2080600ecd5f16254182f8173c23d8c02ac9f9562958954454ffc88320a83154ce828aaab5f337cd6c33efd968ff42f86079f05f
SSDEEP

3072:YbXC2nRetdfSp6TedEh03HzCz3EsT7n+xJ:YbyMhp6Ted603HzCzEsi

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
972	oxmf2679xu.exe
908	oxmf2679xu.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ahi9eb74b = "C:\\Users\\Admin\\AppData\\Roaming\\oxmf2679xu.exe"	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 972 set thread context of 908	972	oxmf2679xu.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1380 wrote to memory of 1672	1380	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	27
PID 1672 wrote to memory of 972	1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	28
PID 1672 wrote to memory of 972	1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	28
PID 1672 wrote to memory of 972	1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	28
PID 1672 wrote to memory of 972	1672	b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe	28
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29
PID 972 wrote to memory of 908	972	oxmf2679xu.exe	29

C:\Users\Admin\AppData\Local\Temp\b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
"C:\Users\Admin\AppData\Local\Temp\b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
  C:\Users\Admin\AppData\Local\Temp\b20aa42ff17effd503ac1daf7a3a7c1c370daca475a7ad93baae56f4a0367d5a.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
    C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
      C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
      4⤵
      Executes dropped EXE
      PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
128KB

MD5
fa1106282318d1c5ca4a424f19a51cff

SHA1
1499836b3b3334ea184bad5fb2bb90aae324163e

SHA256
91b18b21ebb9bf0d0e7eb328e9ade6c161c4ae06dff9e3404904f35dcae80081

SHA512
53d9625e42ed2e6971fed4c1bd85dc06d748d8ba5bb75f6b1712ed07721ee9dbc0ca2affd09cd2c886ae76b0e724de6afa3c79bb03af332e604c07eacd97b112

Download Submit
C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
128KB

MD5
fa1106282318d1c5ca4a424f19a51cff

SHA1
1499836b3b3334ea184bad5fb2bb90aae324163e

SHA256
91b18b21ebb9bf0d0e7eb328e9ade6c161c4ae06dff9e3404904f35dcae80081

SHA512
53d9625e42ed2e6971fed4c1bd85dc06d748d8ba5bb75f6b1712ed07721ee9dbc0ca2affd09cd2c886ae76b0e724de6afa3c79bb03af332e604c07eacd97b112

Download Submit
C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
128KB

MD5
fa1106282318d1c5ca4a424f19a51cff

SHA1
1499836b3b3334ea184bad5fb2bb90aae324163e

SHA256
91b18b21ebb9bf0d0e7eb328e9ade6c161c4ae06dff9e3404904f35dcae80081

SHA512
53d9625e42ed2e6971fed4c1bd85dc06d748d8ba5bb75f6b1712ed07721ee9dbc0ca2affd09cd2c886ae76b0e724de6afa3c79bb03af332e604c07eacd97b112

Download Submit
\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
128KB

MD5
fa1106282318d1c5ca4a424f19a51cff

SHA1
1499836b3b3334ea184bad5fb2bb90aae324163e

SHA256
91b18b21ebb9bf0d0e7eb328e9ade6c161c4ae06dff9e3404904f35dcae80081

SHA512
53d9625e42ed2e6971fed4c1bd85dc06d748d8ba5bb75f6b1712ed07721ee9dbc0ca2affd09cd2c886ae76b0e724de6afa3c79bb03af332e604c07eacd97b112

Download Submit
\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
128KB

MD5
fa1106282318d1c5ca4a424f19a51cff

SHA1
1499836b3b3334ea184bad5fb2bb90aae324163e

SHA256
91b18b21ebb9bf0d0e7eb328e9ade6c161c4ae06dff9e3404904f35dcae80081

SHA512
53d9625e42ed2e6971fed4c1bd85dc06d748d8ba5bb75f6b1712ed07721ee9dbc0ca2affd09cd2c886ae76b0e724de6afa3c79bb03af332e604c07eacd97b112

Download Submit
memory/908-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-59-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing