9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1

General

Target

9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
Size

1.2MB
MD5

f6a0a73b78217f2835a23153fbad16a5
SHA1

c2a7d33a635eb4f6daf32b75ac593b23905fec90
SHA256

9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1
SHA512

6de3695a625ef195730ed76a0149158a16a8e85e0dc12a8fc75b91d06f9f40b4642a16652f4b45caf262fa63da47a7b4ef0b6e4abb690caecfe5176c92582f9b
SSDEEP

12288:wBv7uOLX0KrNe6gtU4fujB8AJIzXwDdBhNYDf3t5:7eZrNt4fujjJYX4Yb3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1412	xdkhEQk1M143lTuV.exe
820	xdkhEQk1M143lTuV.exe

Deletes itself 1 IoCs

pid	Process
820	xdkhEQk1M143lTuV.exe

Loads dropped DLL 4 IoCs

pid	Process
1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
820	xdkhEQk1M143lTuV.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\JGwEXYNB4Pfgo = "C:\\ProgramData\\w9KBNG0K\\xdkhEQk1M143lTuV.exe"	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 1412 set thread context of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 820 set thread context of 324	820	xdkhEQk1M143lTuV.exe	30

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 900 wrote to memory of 1992	900	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	27
PID 1992 wrote to memory of 1412	1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	28
PID 1992 wrote to memory of 1412	1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	28
PID 1992 wrote to memory of 1412	1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	28
PID 1992 wrote to memory of 1412	1992	9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe	28
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 1412 wrote to memory of 820	1412	xdkhEQk1M143lTuV.exe	29
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30
PID 820 wrote to memory of 324	820	xdkhEQk1M143lTuV.exe	30

C:\Users\Admin\AppData\Local\Temp\9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
"C:\Users\Admin\AppData\Local\Temp\9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe
  "C:\Users\Admin\AppData\Local\Temp\9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe
    "C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe
      "C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\Program Files (x86)\Internet Explorer\ExtExport.exe
        
        "C:\Program Files (x86)\Internet Explorer\ExtExport.exe" /i:820
        5⤵
        
        PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
C:\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
\ProgramData\w9KBNG0K\xdkhEQk1M143lTuV.exe

Filesize
1.2MB

MD5
f6a0a73b78217f2835a23153fbad16a5

SHA1
c2a7d33a635eb4f6daf32b75ac593b23905fec90

SHA256
9907b340c005e002e49d580a7758ab4474f968c607bb5871e5f3232cfef028f1

SHA512
6de3695a625ef195730ed76a0149158a16a8e85e0dc12a8fc75b91d06f9f40b4642a16652f4b45caf262fa63da47a7b4ef0b6e4abb690caecfe5176c92582f9b

Download Submit
\Users\Admin\AppData\Local\Temp\U9M8iRT4gRqn.exe

Filesize
1.2MB

MD5
4d6300c175199ed04b6b8aff12e69b86

SHA1
ab2c792dc88471e1557213b2deed442c03372daf

SHA256
fc7a9505b5029de6e4c72589af3124a8bf41c67174982cbcd0599944a6c602f5

SHA512
eb172675925afc14ff150ab2858533d755fd0122f1bd427003aed1068f446bf5cdea6ff9bbb7345d38741c25c564e53cb3f689f8c4983cd834469246b833241f

Download Submit
memory/324-83-0x00000000004475D4-mapping.dmp

Download
memory/324-87-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/324-88-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/820-79-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/820-77-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/820-86-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/820-73-0x00000000004475D4-mapping.dmp

Download
memory/900-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1412-65-0x0000000000000000-mapping.dmp

Download
memory/1992-60-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-66-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-62-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-55-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-57-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1992-58-0x00000000004475D4-mapping.dmp

Download

Analysis

Sharing