1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38

Analysis

max time kernel
175s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe
Size

296KB
MD5

5ca14e99d748f71d726d813bf574b11e
SHA1

fb3eb15fb5d97236625591fd6511459019b8214f
SHA256

1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38
SHA512

be208be98964ee7b2ece5c0a2e5207b7e34406b4b23638168e6185a32dd2f6cf437bc908f39e15c81921174e14e4cc52969e3004ceabb458787eec38faa1a947
SSDEEP

6144:IoOeH4vkd5jIxRFKA5tl1mnLZrWz3ZnnW/Mq3gg+FGtFrKs0MjDTQP/6oHp:IfeH4K5jal4yW/MMnwGtFmsy3P

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4888	iryn.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	iryn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Iryn = "C:\\Users\\Admin\\AppData\\Roaming\\Yrxae\\iryn.exe"	iryn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 2288	440	1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe	82

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe
4888	iryn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4888	440	1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe	81
PID 440 wrote to memory of 4888	440	1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe	81
PID 440 wrote to memory of 4888	440	1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe	81
PID 4888 wrote to memory of 2384	4888	iryn.exe	43
PID 4888 wrote to memory of 2384	4888	iryn.exe	43
PID 4888 wrote to memory of 2384	4888	iryn.exe	43
PID 4888 wrote to memory of 2384	4888	iryn.exe	43
PID 4888 wrote to memory of 2384	4888	iryn.exe	43
PID 4888 wrote to memory of 2456	4888	iryn.exe	44
PID 4888 wrote to memory of 2456	4888	iryn.exe	44
PID 4888 wrote to memory of 2456	4888	iryn.exe	44
PID 4888 wrote to memory of 2456	4888	iryn.exe	44
PID 4888 wrote to memory of 2456	4888	iryn.exe	44
PID 4888 wrote to memory of 2756	4888	iryn.exe	77
PID 4888 wrote to memory of 2756	4888	iryn.exe	77
PID 4888 wrote to memory of 2756	4888	iryn.exe	77
PID 4888 wrote to memory of 2756	4888	iryn.exe	77
PID 4888 wrote to memory of 2756	4888	iryn.exe	77
PID 4888 wrote to memory of 2484	4888	iryn.exe	76
PID 4888 wrote to memory of 2484	4888	iryn.exe	76
PID 4888 wrote to memory of 2484	4888	iryn.exe	76
PID 4888 wrote to memory of 2484	4888	iryn.exe	76
PID 4888 wrote to memory of 2484	4888	iryn.exe	76
PID 4888 wrote to memory of 2780	4888	iryn.exe	75
PID 4888 wrote to memory of 2780	4888	iryn.exe	75
PID 4888 wrote to memory of 2780	4888	iryn.exe	75
PID 4888 wrote to memory of 2780	4888	iryn.exe	75
PID 4888 wrote to memory of 2780	4888	iryn.exe	75
PID 4888 wrote to memory of 3272	4888	iryn.exe	74
PID 4888 wrote to memory of 3272	4888	iryn.exe	74
PID 4888 wrote to memory of 3272	4888	iryn.exe	74
PID 4888 wrote to memory of 3272	4888	iryn.exe	74
PID 4888 wrote to memory of 3272	4888	iryn.exe	74
PID 4888 wrote to memory of 3364	4888	iryn.exe	73
PID 4888 wrote to memory of 3364	4888	iryn.exe	73
PID 4888 wrote to memory of 3364	4888	iryn.exe	73
PID 4888 wrote to memory of 3364	4888	iryn.exe	73
PID 4888 wrote to memory of 3364	4888	iryn.exe	73
PID 4888 wrote to memory of 3424	4888	iryn.exe	53
PID 4888 wrote to memory of 3424	4888	iryn.exe	53
PID 4888 wrote to memory of 3424	4888	iryn.exe	53
PID 4888 wrote to memory of 3424	4888	iryn.exe	53
PID 4888 wrote to memory of 3424	4888	iryn.exe	53
PID 4888 wrote to memory of 3516	4888	iryn.exe	72
PID 4888 wrote to memory of 3516	4888	iryn.exe	72
PID 4888 wrote to memory of 3516	4888	iryn.exe	72
PID 4888 wrote to memory of 3516	4888	iryn.exe	72
PID 4888 wrote to memory of 3516	4888	iryn.exe	72
PID 4888 wrote to memory of 3696	4888	iryn.exe	71
PID 4888 wrote to memory of 3696	4888	iryn.exe	71
PID 4888 wrote to memory of 3696	4888	iryn.exe	71
PID 4888 wrote to memory of 3696	4888	iryn.exe	71
PID 4888 wrote to memory of 3696	4888	iryn.exe	71
PID 4888 wrote to memory of 4648	4888	iryn.exe	68
PID 4888 wrote to memory of 4648	4888	iryn.exe	68
PID 4888 wrote to memory of 4648	4888	iryn.exe	68
PID 4888 wrote to memory of 4648	4888	iryn.exe	68
PID 4888 wrote to memory of 4648	4888	iryn.exe	68
PID 4888 wrote to memory of 440	4888	iryn.exe	78
PID 4888 wrote to memory of 440	4888	iryn.exe	78
PID 4888 wrote to memory of 440	4888	iryn.exe	78
PID 4888 wrote to memory of 440	4888	iryn.exe	78
PID 4888 wrote to memory of 440	4888	iryn.exe	78
PID 440 wrote to memory of 2288	440	1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe	82

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3364

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2780

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2484
- C:\Users\Admin\AppData\Local\Temp\1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe
  "C:\Users\Admin\AppData\Local\Temp\1a252aca8dd53842529529aff8eafa6ccb495a7c7efd0ef7b421bb8d34261b38.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Users\Admin\AppData\Roaming\Yrxae\iryn.exe
    "C:\Users\Admin\AppData\Roaming\Yrxae\iryn.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\LEO34A7.bat"
    3⤵
    PID:2288

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LEO34A7.bat

Filesize
303B

MD5
7daa21406a05f4f0bac259152c29299d

SHA1
5c5e61ee71bdfaff34dfd116001894bd307b5073

SHA256
674e52e892302c608159467017741a9996cd8af55396e08277f86e5f62a73985

SHA512
8b52dbae03c8cb653b844126aad2687fffdd26a6561934d73bea4bfa302a04be705e0a2da019796dbd3638d9fe9f833eeb0c2628539403d775ddbaed7944d29e

Download Submit
C:\Users\Admin\AppData\Roaming\Yrxae\iryn.exe

Filesize
296KB

MD5
103661c12a3edea200cdb39a93baa7a8

SHA1
5d00165b7dd962c6b60b075c2072571eb9c068ee

SHA256
f678f6c34cdd23baec1cfeffe4c64ebfbe169b6cec746797a9c4040e75f2f6a7

SHA512
c673dfcadfd9fdf49ae5b9f778d169f44154a6953208581b60798723434f74dd581f81da7d4087c00496c5342f5c4dcf621db94d2e7185c130ac54edb48cee44

Download Submit
C:\Users\Admin\AppData\Roaming\Yrxae\iryn.exe

Filesize
296KB

MD5
103661c12a3edea200cdb39a93baa7a8

SHA1
5d00165b7dd962c6b60b075c2072571eb9c068ee

SHA256
f678f6c34cdd23baec1cfeffe4c64ebfbe169b6cec746797a9c4040e75f2f6a7

SHA512
c673dfcadfd9fdf49ae5b9f778d169f44154a6953208581b60798723434f74dd581f81da7d4087c00496c5342f5c4dcf621db94d2e7185c130ac54edb48cee44

Download Submit
memory/440-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-155-0x0000000002240000-0x0000000002289000-memory.dmp

Filesize
292KB

Download
memory/440-133-0x0000000000401000-0x0000000000442000-memory.dmp

Filesize
260KB

Download
memory/440-139-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-140-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-141-0x0000000002240000-0x0000000002289000-memory.dmp

Filesize
292KB

Download
memory/440-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/440-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2288-147-0x0000000000790000-0x00000000007D9000-memory.dmp

Filesize
292KB

Download
memory/2288-149-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-148-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-151-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-150-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2288-156-0x0000000000790000-0x00000000007D9000-memory.dmp

Filesize
292KB

Download
memory/4888-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download