b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

General

Target

b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Size

267KB
MD5

295e0a20d9baa8f6565d293a7637f670
SHA1

273587911419d798d9d7f16f759c59f69f0972ca
SHA256

b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174
SHA512

1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8
SSDEEP

6144:KxZasmAMSle58AP7tmUk09zspjQi6i8xgWzDyQh+f+MmnQ:KBmAMjtPwUVpksvqWzONm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
628	xXh3ljXkxqqWTwZC.exe
1124	xXh3ljXkxqqWTwZC.exe

Deletes itself 1 IoCs

pid	Process
1124	xXh3ljXkxqqWTwZC.exe

Loads dropped DLL 4 IoCs

pid	Process
1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
1124	xXh3ljXkxqqWTwZC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ptsfzfw7QjROg = "C:\\ProgramData\\1Y8PwDQR4P\\xXh3ljXkxqqWTwZC.exe"	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 628 set thread context of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 1124 set thread context of 1668	1124	xXh3ljXkxqqWTwZC.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1112 wrote to memory of 1384	1112	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	26
PID 1384 wrote to memory of 628	1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	27
PID 1384 wrote to memory of 628	1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	27
PID 1384 wrote to memory of 628	1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	27
PID 1384 wrote to memory of 628	1384	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	27
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 628 wrote to memory of 1124	628	xXh3ljXkxqqWTwZC.exe	28
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29
PID 1124 wrote to memory of 1668	1124	xXh3ljXkxqqWTwZC.exe	29

C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
"C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
  "C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe
    "C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe
      "C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1124
    - - C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe" /i:1124
        5⤵
        
        PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

Filesize
267KB

MD5
295e0a20d9baa8f6565d293a7637f670

SHA1
273587911419d798d9d7f16f759c59f69f0972ca

SHA256
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

SHA512
1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8

Download Submit
\Users\Admin\AppData\Local\Temp\01zRWddLRV.exe

Filesize
267KB

MD5
d73b562268e1342ad98d32c7d208859f

SHA1
47028d6273745af323b35930976ddb58c6b79c21

SHA256
0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

SHA512
28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

Download Submit
memory/1124-75-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1124-84-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1124-77-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-61-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-66-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-85-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-86-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing