b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

General

Target

b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Size

267KB
MD5

295e0a20d9baa8f6565d293a7637f670
SHA1

273587911419d798d9d7f16f759c59f69f0972ca
SHA256

b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174
SHA512

1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8
SSDEEP

6144:KxZasmAMSle58AP7tmUk09zspjQi6i8xgWzDyQh+f+MmnQ:KBmAMjtPwUVpksvqWzONm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3180	QXC1WoiQdsmJUm.exe
4964	QXC1WoiQdsmJUm.exe

Loads dropped DLL 4 IoCs

pid	Process
2432	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
2432	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
4964	QXC1WoiQdsmJUm.exe
4964	QXC1WoiQdsmJUm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jYYuYtOtZEdcGbry = "C:\\ProgramData\\5BcdqPoejPBva4\\QXC1WoiQdsmJUm.exe"	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 3180 set thread context of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 4964 set thread context of 1568	4964	QXC1WoiQdsmJUm.exe	87

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 4856 wrote to memory of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 4856 wrote to memory of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 4856 wrote to memory of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 4856 wrote to memory of 2432	4856	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	82
PID 2432 wrote to memory of 3180	2432	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	84
PID 2432 wrote to memory of 3180	2432	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	84
PID 2432 wrote to memory of 3180	2432	b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe	84
PID 3180 wrote to memory of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 3180 wrote to memory of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 3180 wrote to memory of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 3180 wrote to memory of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 3180 wrote to memory of 4964	3180	QXC1WoiQdsmJUm.exe	85
PID 4964 wrote to memory of 1568	4964	QXC1WoiQdsmJUm.exe	87
PID 4964 wrote to memory of 1568	4964	QXC1WoiQdsmJUm.exe	87
PID 4964 wrote to memory of 1568	4964	QXC1WoiQdsmJUm.exe	87
PID 4964 wrote to memory of 1568	4964	QXC1WoiQdsmJUm.exe	87
PID 4964 wrote to memory of 1568	4964	QXC1WoiQdsmJUm.exe	87

C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
"C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
  "C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe
    "C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe
      "C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe" /i:4964
        5⤵
        
        PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe

Filesize
267KB

MD5
295e0a20d9baa8f6565d293a7637f670

SHA1
273587911419d798d9d7f16f759c59f69f0972ca

SHA256
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

SHA512
1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8

Download Submit
C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe

Filesize
267KB

MD5
295e0a20d9baa8f6565d293a7637f670

SHA1
273587911419d798d9d7f16f759c59f69f0972ca

SHA256
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

SHA512
1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8

Download Submit
C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe

Filesize
267KB

MD5
3a5a2cbec564eb76b606e6a186e8dced

SHA1
d7b68727f48b7cf3b25b4b2db9a8c4cd8cf3bdcb

SHA256
8d8b5c80463e112f666f85177fc1d5e06bc61075a8ea33b9ea79d8e21b758be9

SHA512
460cc0037f1d6237d50a64092e14f622abefc805cb1a25067b4d982f44983c24760c557eca341154eb00a2fab1dd2ee7b341b235dbda6f96ac1927c94d27633c

Download Submit
C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe

Filesize
267KB

MD5
3a5a2cbec564eb76b606e6a186e8dced

SHA1
d7b68727f48b7cf3b25b4b2db9a8c4cd8cf3bdcb

SHA256
8d8b5c80463e112f666f85177fc1d5e06bc61075a8ea33b9ea79d8e21b758be9

SHA512
460cc0037f1d6237d50a64092e14f622abefc805cb1a25067b4d982f44983c24760c557eca341154eb00a2fab1dd2ee7b341b235dbda6f96ac1927c94d27633c

Download Submit
C:\ProgramData\5BcdqPoejPBva4\QXC1WoiQdsmJUm.exe

Filesize
267KB

MD5
3a5a2cbec564eb76b606e6a186e8dced

SHA1
d7b68727f48b7cf3b25b4b2db9a8c4cd8cf3bdcb

SHA256
8d8b5c80463e112f666f85177fc1d5e06bc61075a8ea33b9ea79d8e21b758be9

SHA512
460cc0037f1d6237d50a64092e14f622abefc805cb1a25067b4d982f44983c24760c557eca341154eb00a2fab1dd2ee7b341b235dbda6f96ac1927c94d27633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9mKBcnlDzTeI.exe

Filesize
267KB

MD5
3a5a2cbec564eb76b606e6a186e8dced

SHA1
d7b68727f48b7cf3b25b4b2db9a8c4cd8cf3bdcb

SHA256
8d8b5c80463e112f666f85177fc1d5e06bc61075a8ea33b9ea79d8e21b758be9

SHA512
460cc0037f1d6237d50a64092e14f622abefc805cb1a25067b4d982f44983c24760c557eca341154eb00a2fab1dd2ee7b341b235dbda6f96ac1927c94d27633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9mKBcnlDzTeI.exe

Filesize
267KB

MD5
3a5a2cbec564eb76b606e6a186e8dced

SHA1
d7b68727f48b7cf3b25b4b2db9a8c4cd8cf3bdcb

SHA256
8d8b5c80463e112f666f85177fc1d5e06bc61075a8ea33b9ea79d8e21b758be9

SHA512
460cc0037f1d6237d50a64092e14f622abefc805cb1a25067b4d982f44983c24760c557eca341154eb00a2fab1dd2ee7b341b235dbda6f96ac1927c94d27633c

Download Submit
memory/1568-159-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1568-158-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2432-135-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2432-138-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2432-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2432-142-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2432-133-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4964-151-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4964-157-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4964-150-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing