b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099

General

Target

b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
Size

45KB
MD5

78e94ee146e48e6f84d6fe681c80d812
SHA1

73c06e7aa0a0d48c79520a6971553d1b378a5136
SHA256

b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099
SHA512

4e9c87ba0f7c933671751e9e77aea2123589761cddf8e02fc570b0d26a1f897c913ad3cf13bc51b6cded972f18e53947527fa6cc90e2120e7c0fad3207b6b920
SSDEEP

768:2wuEVsNpKdxulBo6LLfI0bntP45CTsqsUryfqkR4k1+m2VAG/IYAk5mrvk6aqRT:2iiWulVLEUDfRsq5kQm0AG/nmnf

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4924	netsh.exe
4828	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tWaDLkO = "C:\\Users\\Admin\\AppData\\Roaming\\tWaDLkO\\tWaDLkO.exe"	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\H:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\T:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\X:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\Z:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\J:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\O:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\Q:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\K:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\L:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\M:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\P:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\R:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\E:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\G:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\I:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\W:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\S:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\U:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\V:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\B:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\N:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
File opened (read-only)	\??\Y:	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4924	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	80
PID 4848 wrote to memory of 4924	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	80
PID 4848 wrote to memory of 4924	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	80
PID 4848 wrote to memory of 4844	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	81
PID 4848 wrote to memory of 4844	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	81
PID 4848 wrote to memory of 4844	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	81
PID 4848 wrote to memory of 4844	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	81
PID 4848 wrote to memory of 4844	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	81
PID 4848 wrote to memory of 4828	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	82
PID 4848 wrote to memory of 4828	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	82
PID 4848 wrote to memory of 4828	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	82
PID 4848 wrote to memory of 4588	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	85
PID 4848 wrote to memory of 4588	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	85
PID 4848 wrote to memory of 4588	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	85
PID 4848 wrote to memory of 4588	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	85
PID 4848 wrote to memory of 4588	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	85
PID 4848 wrote to memory of 1016	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	9
PID 4848 wrote to memory of 1016	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	9
PID 4848 wrote to memory of 3048	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	51
PID 4848 wrote to memory of 3048	4848	b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe	51

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048
- C:\Users\Admin\AppData\Local\Temp\b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe
  "C:\Users\Admin\AppData\Local\Temp\b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099.exe"
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\netsh.exe
    firewall add rule name="Internet Explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4924
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\netsh.exe
    firewall add allowedprogram mode=ENABLE profile=ALL name="Internet Explore" program="C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe"
    3⤵
    - Modifies Windows Firewall
    PID:4828
- - C:\Windows\SysWOW64\charmap.exe
    "C:\Windows\system32\charmap.exe"
    3⤵
    PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe

Filesize
45KB

MD5
78e94ee146e48e6f84d6fe681c80d812

SHA1
73c06e7aa0a0d48c79520a6971553d1b378a5136

SHA256
b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099

SHA512
4e9c87ba0f7c933671751e9e77aea2123589761cddf8e02fc570b0d26a1f897c913ad3cf13bc51b6cded972f18e53947527fa6cc90e2120e7c0fad3207b6b920

Download Submit
C:\Users\Admin\AppData\Roaming\tWaDLkO\tWaDLkO.exe

Filesize
45KB

MD5
78e94ee146e48e6f84d6fe681c80d812

SHA1
73c06e7aa0a0d48c79520a6971553d1b378a5136

SHA256
b6ac53f9b3debc05da150be0295667bc5fcc0804597c6ada70cffb930c84c099

SHA512
4e9c87ba0f7c933671751e9e77aea2123589761cddf8e02fc570b0d26a1f897c913ad3cf13bc51b6cded972f18e53947527fa6cc90e2120e7c0fad3207b6b920

Download Submit
memory/4848-136-0x0000000000F00000-0x0000000000F21000-memory.dmp

Filesize
132KB

Download
memory/4848-139-0x0000000000F00000-0x0000000000F21000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing