436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d

General

Target

436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
Size

116KB
MD5

66289673eb69aaea1d0e639cd9bf0eb8
SHA1

31e5f29beb3cccad6d2ccace553709df1c7c7791
SHA256

436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d
SHA512

98883a774e3dea9369bc1c7986498d8ab585c06918073989de87f39281ef3c06f75a305b49c840a6a3a73dff481abdcd48dbb7aaf3de03089f1a442f8c24ea99
SSDEEP

1536:ZnAADEXD7+kk1MWtKzobMREQjkBrs9M1bTUVqddfdIl0ET/NKTNGI9ME5aC1Uk3:ZHPt/QR1Is21xdd15ETFKRbMZCB

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1532	netprotocol.exe
1504	netprotocol.exe

Loads dropped DLL 2 IoCs

pid	Process
1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1532 set thread context of 1504	1532	netprotocol.exe	31

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1640 wrote to memory of 1596	1640	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	28
PID 1596 wrote to memory of 1532	1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	29
PID 1596 wrote to memory of 1532	1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	29
PID 1596 wrote to memory of 1532	1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	29
PID 1596 wrote to memory of 1532	1596	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	29
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31
PID 1532 wrote to memory of 1504	1532	netprotocol.exe	31

C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
"C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
  C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
memory/1504-75-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1596-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1596-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1596-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1596-59-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1596-56-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1596-76-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing