9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635

General

Target

9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
Size

118KB
MD5

ff45cd54f807e15aa5d55c51ad4fc949
SHA1

35d19024bd08b379b3f78d8444acea3ec3932ea4
SHA256

9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635
SHA512

c96d261acbf0d1a0e8fd9ca9070d0a443277442b9391fe42070d657c9a270820c554c8176e8d72be3043591ab3763c5590716efa4959301596bdbd1ecc28cabe
SSDEEP

3072:pLWTEiR+gctabvQuKbtG3ftk3j30lQqAB1kO0exnr:pLWiYTQPG3VQya6O0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2044	oxmf2679xu.exe
1720	oxmf2679xu.exe

Loads dropped DLL 2 IoCs

pid	Process
1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ahi9eb74b = "C:\\Users\\Admin\\AppData\\Roaming\\oxmf2679xu.exe"	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 2044 set thread context of 1720	2044	oxmf2679xu.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1416 wrote to memory of 1224	1416	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	27
PID 1224 wrote to memory of 2044	1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	28
PID 1224 wrote to memory of 2044	1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	28
PID 1224 wrote to memory of 2044	1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	28
PID 1224 wrote to memory of 2044	1224	9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe	28
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29
PID 2044 wrote to memory of 1720	2044	oxmf2679xu.exe	29

C:\Users\Admin\AppData\Local\Temp\9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
"C:\Users\Admin\AppData\Local\Temp\9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
  C:\Users\Admin\AppData\Local\Temp\9e4d266fc5103fea30210552a5cea75732f1e93025f8b5fd598562fe8e8fa635.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
    C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
      C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe
      4⤵
      Executes dropped EXE
      PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
118KB

MD5
a77ffdb8e02269a50fb4a44983310321

SHA1
1fde9a14e5db7b7154e98e7783b35914ee7a42a5

SHA256
eb3aa56f5b7148265198b4bdb359c4842b16a3a59731c87994d3b6702c59da1d

SHA512
db3b5c5bacb757ebd93cc136ff4e073f1f2ccf49f2f08ba8e0e1217c801d7ccea6914b04f0e1a941cd4060b06e2dbc6bab6c303b1a2a13b48509c82d54a7efbd

Download Submit
C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
118KB

MD5
a77ffdb8e02269a50fb4a44983310321

SHA1
1fde9a14e5db7b7154e98e7783b35914ee7a42a5

SHA256
eb3aa56f5b7148265198b4bdb359c4842b16a3a59731c87994d3b6702c59da1d

SHA512
db3b5c5bacb757ebd93cc136ff4e073f1f2ccf49f2f08ba8e0e1217c801d7ccea6914b04f0e1a941cd4060b06e2dbc6bab6c303b1a2a13b48509c82d54a7efbd

Download Submit
C:\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
118KB

MD5
a77ffdb8e02269a50fb4a44983310321

SHA1
1fde9a14e5db7b7154e98e7783b35914ee7a42a5

SHA256
eb3aa56f5b7148265198b4bdb359c4842b16a3a59731c87994d3b6702c59da1d

SHA512
db3b5c5bacb757ebd93cc136ff4e073f1f2ccf49f2f08ba8e0e1217c801d7ccea6914b04f0e1a941cd4060b06e2dbc6bab6c303b1a2a13b48509c82d54a7efbd

Download Submit
\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
118KB

MD5
a77ffdb8e02269a50fb4a44983310321

SHA1
1fde9a14e5db7b7154e98e7783b35914ee7a42a5

SHA256
eb3aa56f5b7148265198b4bdb359c4842b16a3a59731c87994d3b6702c59da1d

SHA512
db3b5c5bacb757ebd93cc136ff4e073f1f2ccf49f2f08ba8e0e1217c801d7ccea6914b04f0e1a941cd4060b06e2dbc6bab6c303b1a2a13b48509c82d54a7efbd

Download Submit
\Users\Admin\AppData\Roaming\oxmf2679xu.exe

Filesize
118KB

MD5
a77ffdb8e02269a50fb4a44983310321

SHA1
1fde9a14e5db7b7154e98e7783b35914ee7a42a5

SHA256
eb3aa56f5b7148265198b4bdb359c4842b16a3a59731c87994d3b6702c59da1d

SHA512
db3b5c5bacb757ebd93cc136ff4e073f1f2ccf49f2f08ba8e0e1217c801d7ccea6914b04f0e1a941cd4060b06e2dbc6bab6c303b1a2a13b48509c82d54a7efbd

Download Submit
memory/1224-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1224-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1224-59-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1224-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1720-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1720-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1720-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing