a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad

General

Target

a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
Size

29KB
MD5

837f699cab9df14f219a3ab8a578b100
SHA1

9f1587ac07c32c4dc26c785ef9e1406bf7aad654
SHA256

a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad
SHA512

928a1a56cd8f0fde326d42000a59c324a76228261e8f9d9607e6a013d7ca91d5d2417fa988a2bbacc5fb4f08a2760aaf656acd9cc505ab8e29a64ede859cb0d2
SSDEEP

384:hgtCIKJbqX10XDrjbxq2hxs4M9gym5bfaAD3H0zYiwHCFn1el9TSs3zN:hgL1wX+h9ipfaADEzxQSs3J

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2012	NÒldr.exe
568	NÒldr.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\NÒldr.exe"	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	NÒldr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\NÒldr.exe"	NÒldr.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NÒldr.exe	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
File created	C:\Windows\SysWOW64\NÒldr.exe	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
File opened for modification	C:\Windows\SysWOW64\RCXA516.tmp	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
File opened for modification	C:\Windows\SysWOW64\NÒldr.exe	NÒldr.exe
File created	C:\Windows\SysWOW64\NÒldr.exe	NÒldr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2012	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	28
PID 1704 wrote to memory of 2012	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	28
PID 1704 wrote to memory of 2012	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	28
PID 1704 wrote to memory of 2012	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	28
PID 1704 wrote to memory of 1124	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	29
PID 1704 wrote to memory of 1124	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	29
PID 1704 wrote to memory of 1124	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	29
PID 1704 wrote to memory of 1124	1704	a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe	29
PID 2012 wrote to memory of 568	2012	NÒldr.exe	30
PID 2012 wrote to memory of 568	2012	NÒldr.exe	30
PID 2012 wrote to memory of 568	2012	NÒldr.exe	30
PID 2012 wrote to memory of 568	2012	NÒldr.exe	30

C:\Users\Admin\AppData\Local\Temp\a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
"C:\Users\Admin\AppData\Local\Temp\a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\NÒldr.exe
  "C:\Windows\system32\NÒldr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\NÒldr.exe
    C:\Windows\SysWOW64\NÒldr.exe
    3⤵
    - Executes dropped EXE
    PID:568
- C:\Users\Admin\AppData\Local\Temp\a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
  C:\Users\Admin\AppData\Local\Temp\a41177ec67ed7357129d4ba57648ec31c7149ee4dda0cad8aa684a49cce2f8ad.exe
  2⤵
  PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
memory/1704-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing