612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368

General

Target

612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
Size

361KB
MD5

d988f7c24487d404f70c1b65df1281b1
SHA1

2d936e717f028e3bf261b5ee4303f2534c4298be
SHA256

612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368
SHA512

b47f9e50da92f82d2d443489f7ae899f1c68d2bbef5fb4e646d4780a0bc2da7fc6245f6ffdebaec21b36a42fb243bffb304a83bdf83e0e3507e4cf60ea94c94e
SSDEEP

6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1640	fqngcvpletmfcvrk.exe

Loads dropped DLL 1 IoCs

pid	Process
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1640	fqngcvpletmfcvrk.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1640	fqngcvpletmfcvrk.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1640	fqngcvpletmfcvrk.exe
1640	fqngcvpletmfcvrk.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1640	fqngcvpletmfcvrk.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1640	fqngcvpletmfcvrk.exe
1640	fqngcvpletmfcvrk.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1640	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	28
PID 1784 wrote to memory of 1640	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	28
PID 1784 wrote to memory of 1640	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	28
PID 1784 wrote to memory of 1640	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	28
PID 1784 wrote to memory of 1172	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	29
PID 1784 wrote to memory of 1172	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	29
PID 1784 wrote to memory of 1172	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	29
PID 1784 wrote to memory of 1172	1784	612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe	29

C:\Users\Admin\AppData\Local\Temp\612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe
"C:\Users\Admin\AppData\Local\Temp\612937de6a7ae573ff13b36879bdc62669fa8c3cd3dd4ef471f8fd12942da368.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Temp\fqngcvpletmfcvrk.exe
  C:\Temp\fqngcvpletmfcvrk.exe run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\fqngcvpletmfcvrk.exe

Filesize
361KB

MD5
b88b864c95c9d929c32cef9ac294b3dc

SHA1
d796b4b667932f6c553048b5875475559f844225

SHA256
29f492af22f5aa534569e83623ed98a9dc63b01abf243f38e5cd9c98c439cff3

SHA512
a5d8cb3bd1456a74b63511668d3736de57ebbae871b6021a511c7ad78e68793e57632d96963fb8191781a5bf48c61e73c5e715a6ff741c18969272c35d76bfcd

Download Submit
\Temp\fqngcvpletmfcvrk.exe

Filesize
361KB

MD5
b88b864c95c9d929c32cef9ac294b3dc

SHA1
d796b4b667932f6c553048b5875475559f844225

SHA256
29f492af22f5aa534569e83623ed98a9dc63b01abf243f38e5cd9c98c439cff3

SHA512
a5d8cb3bd1456a74b63511668d3736de57ebbae871b6021a511c7ad78e68793e57632d96963fb8191781a5bf48c61e73c5e715a6ff741c18969272c35d76bfcd

Download Submit

Analysis

Sharing