c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1

General

Target

c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
Size

351KB
MD5

32de5e29669cf98e46462f8189fa3162
SHA1

1c9331f0d0f0d64850ddac8c4ad558b21cb36e16
SHA256

c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1
SHA512

f4df1c8c41b75561fecf74e09a198cea7d7b9390113a06368e4f4c774644b1d04ac37ab3c5e9c583955b7d1f3fff4f49374a0ffbeea71c6da4365011716e2913
SSDEEP

6144:Z3c4cg0RO2MKBH6r9/XbaI6Y3g53F9ifdyovpeVzyg6QoyD2dNl9:ZiBTMKBHS/g53KfdFpJg+yadNX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
952	fhAdolze4.exe
1544	fhAdolze4.exe

Deletes itself 1 IoCs

pid	Process
1544	fhAdolze4.exe

Loads dropped DLL 4 IoCs

pid	Process
1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
1544	fhAdolze4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\PZLvkQSadH7v6b = "C:\\ProgramData\\V5GSkOlJ86Z4hz\\fhAdolze4.exe"	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 952 set thread context of 1544	952	fhAdolze4.exe	30
PID 1544 set thread context of 1572	1544	fhAdolze4.exe	31

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1356 wrote to memory of 1668	1356	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	28
PID 1668 wrote to memory of 952	1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	29
PID 1668 wrote to memory of 952	1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	29
PID 1668 wrote to memory of 952	1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	29
PID 1668 wrote to memory of 952	1668	c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe	29
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 952 wrote to memory of 1544	952	fhAdolze4.exe	30
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31
PID 1544 wrote to memory of 1572	1544	fhAdolze4.exe	31

C:\Users\Admin\AppData\Local\Temp\c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
"C:\Users\Admin\AppData\Local\Temp\c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe
  "C:\Users\Admin\AppData\Local\Temp\c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe
    "C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe
      "C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe" /i:1544
        5⤵
        
        PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
C:\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
\ProgramData\V5GSkOlJ86Z4hz\fhAdolze4.exe

Filesize
351KB

MD5
32de5e29669cf98e46462f8189fa3162

SHA1
1c9331f0d0f0d64850ddac8c4ad558b21cb36e16

SHA256
c34968cf5cc365d8c41618e4383ee0200326fe56865cb65e13931716ded421f1

SHA512
f4df1c8c41b75561fecf74e09a198cea7d7b9390113a06368e4f4c774644b1d04ac37ab3c5e9c583955b7d1f3fff4f49374a0ffbeea71c6da4365011716e2913

Download Submit
\Users\Admin\AppData\Local\Temp\tBWBkELe.exe

Filesize
351KB

MD5
8aba2a1642a3022b48de657f146b8698

SHA1
afea12430bc9f3678c8bd43c1f6fc20fed188637

SHA256
b97321e1dfb1afaabb3342bff81973698d7d036f52a958eb8d23838381960452

SHA512
fed14fa6834084cd740c18956caf99f21dc56019fbebfaa402701c42fe16180cc478dcf870e1d83c0e0231cbcbfe3f7a71f7a4a4307315297f12425a1ddfa2db

Download Submit
memory/1544-74-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1544-82-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1572-84-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1572-83-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-65-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing