de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb

General

Target

de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
Size

411KB
MD5

daa1ca3db84279c6104551ded4035c48
SHA1

fdeea70a779146e9a648a87528e5e3d344ebc0db
SHA256

de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb
SHA512

67801d0e933adebf0ecf49ddf75e02123477a68954fa0873ea0da57cc99721fe3f89b818e8b6d6a3fc9e92c96be5f96ebdadd0777c8d5469e746ddcf336dee01
SSDEEP

6144:9GK723lL97i0rkf+ElKaCa+Ni2rqES8VITfR:9pOL9DLAKXaJjTJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1352	LXW0TBffweBSRs.exe
1052	LXW0TBffweBSRs.exe

Deletes itself 1 IoCs

pid	Process
1052	LXW0TBffweBSRs.exe

Loads dropped DLL 4 IoCs

pid	Process
1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
1052	LXW0TBffweBSRs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\0bltZf5lCPSUBWS = "C:\\ProgramData\\MVDmWc5Cbd9s\\LXW0TBffweBSRs.exe"	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1352 set thread context of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1052 set thread context of 1240	1052	LXW0TBffweBSRs.exe	30

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1044 wrote to memory of 1428	1044	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	27
PID 1428 wrote to memory of 1352	1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	28
PID 1428 wrote to memory of 1352	1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	28
PID 1428 wrote to memory of 1352	1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	28
PID 1428 wrote to memory of 1352	1428	de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe	28
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1352 wrote to memory of 1052	1352	LXW0TBffweBSRs.exe	29
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30
PID 1052 wrote to memory of 1240	1052	LXW0TBffweBSRs.exe	30

C:\Users\Admin\AppData\Local\Temp\de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
"C:\Users\Admin\AppData\Local\Temp\de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe
  "C:\Users\Admin\AppData\Local\Temp\de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe
    "C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe
      "C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Program Files (x86)\Internet Explorer\ielowutil.exe
        
        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" /i:1052
        5⤵
        
        PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
C:\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
\ProgramData\MVDmWc5Cbd9s\LXW0TBffweBSRs.exe

Filesize
411KB

MD5
daa1ca3db84279c6104551ded4035c48

SHA1
fdeea70a779146e9a648a87528e5e3d344ebc0db

SHA256
de4e90bac01ef55f6ea890c75bb6cfdb5a03320e3937993dc5fd4f236cf834eb

SHA512
67801d0e933adebf0ecf49ddf75e02123477a68954fa0873ea0da57cc99721fe3f89b818e8b6d6a3fc9e92c96be5f96ebdadd0777c8d5469e746ddcf336dee01

Download Submit
\Users\Admin\AppData\Local\Temp\rQqGVyjdOZOz.exe

Filesize
411KB

MD5
049eb4ec41aa93ae3df3d798c44ccf74

SHA1
358a40b694cdda8eaa3d07a2dadcb6018d58eb11

SHA256
1d35e0d1ad5385e9e8bde973208833d9ffb46a43ad8ee96c22f74053e9ff95ff

SHA512
aed64b449a38be2eb0e57e60a3c33cb881e6a6dfd8160136eaae20271bb233c45aaaefd6ecd7e1b145dba49672016310a3a24a62821018686e8a444ea045ce83

Download Submit
memory/1052-82-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1052-75-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1240-84-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1240-83-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-65-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing