436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d

General

Target

436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
Size

116KB
MD5

66289673eb69aaea1d0e639cd9bf0eb8
SHA1

31e5f29beb3cccad6d2ccace553709df1c7c7791
SHA256

436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d
SHA512

98883a774e3dea9369bc1c7986498d8ab585c06918073989de87f39281ef3c06f75a305b49c840a6a3a73dff481abdcd48dbb7aaf3de03089f1a442f8c24ea99
SSDEEP

1536:ZnAADEXD7+kk1MWtKzobMREQjkBrs9M1bTUVqddfdIl0ET/NKTNGI9ME5aC1Uk3:ZHPt/QR1Is21xdd15ETFKRbMZCB

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2336	netprotocol.exe
1456	netprotocol.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 2336 set thread context of 1456	2336	netprotocol.exe	85

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 3464 wrote to memory of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 3464 wrote to memory of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 3464 wrote to memory of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 3464 wrote to memory of 4916	3464	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	82
PID 4916 wrote to memory of 2336	4916	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	84
PID 4916 wrote to memory of 2336	4916	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	84
PID 4916 wrote to memory of 2336	4916	436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe	84
PID 2336 wrote to memory of 1456	2336	netprotocol.exe	85
PID 2336 wrote to memory of 1456	2336	netprotocol.exe	85
PID 2336 wrote to memory of 1456	2336	netprotocol.exe	85
PID 2336 wrote to memory of 1456	2336	netprotocol.exe	85
PID 2336 wrote to memory of 1456	2336	netprotocol.exe	85

C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
"C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
  C:\Users\Admin\AppData\Local\Temp\436f8d624e5a4c72d4f85b940b6d9c82e249bf7a666c919c48e987c96f67e12d.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
116KB

MD5
f3d59037bf5c2f804a3f55daddd15ec6

SHA1
61aac58f9225c82be9f62429104621e60362cd6d

SHA256
c074cfc9de3e7dc57ac430ad9011965c83c8bd639c16a49650e35eef60762876

SHA512
6137f9b575d4ad56ccff466efab52ecf1ab1e297193fc7b5c63d039d181c44479923d7a58402e32419bd71a873a3b54dcedb565240cb6a01c8cc99256fd44704

Download Submit
memory/1456-143-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1456-144-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1456-145-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4916-135-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4916-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4916-133-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4916-139-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4916-146-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing