a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076

General

Target

a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
Size

1.5MB
MD5

87150f1823d978c6f64292f49a7fc476
SHA1

b83926e4f0799afc96e83e7521cc4b8fd266773b
SHA256

a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076
SHA512

91206bc6380145cbdf8bd361b83195a2109f1c4ce749566c852cf11c0557769e6cf83b800ffd4b220ccdde95908046c2713b901c96568a80cae5ee6a890cc26c
SSDEEP

24576:yy4e+kpDN5NoJndLG4mnAYYzWne8cJ3Jf3Zp1hXYAKhb/tKXH4JWZ9ZXm:ZTDL6bqYzWdcJ3tZpGztOsWnZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1164	Rundll32.exe
4804	Rundll32.exe
3252	wrar380tr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 4804	1164	Rundll32.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	4804	WerFault.exe	84

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1164	Rundll32.exe
3252	wrar380tr.exe
3252	wrar380tr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1164	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	83
PID 3832 wrote to memory of 1164	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	83
PID 3832 wrote to memory of 1164	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	83
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 1164 wrote to memory of 4804	1164	Rundll32.exe	84
PID 3832 wrote to memory of 3252	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	87
PID 3832 wrote to memory of 3252	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	87
PID 3832 wrote to memory of 3252	3832	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	87

C:\Users\Admin\AppData\Local\Temp\a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
"C:\Users\Admin\AppData\Local\Temp\a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 572
      4⤵
      Program crash
      PID:4304
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4804 -ip 4804
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe

Filesize
1.4MB

MD5
4a285ba4158202cc3a064cfe9f1f2b45

SHA1
ccd3ae603ad782a6de5c40b31dd73fd51646725d

SHA256
56dbbe6eedb45676dde627587576afe27b7aab9c99d5f2a1a33fb321ea8d5348

SHA512
baf59787e04c0688320d451e4b2bc707c3890176c0f3dcd2089d453886362a55bc8ba697ef45e529022d2cf138a91092d7640ba1be10553e70eada21250c2da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe

Filesize
1.4MB

MD5
4a285ba4158202cc3a064cfe9f1f2b45

SHA1
ccd3ae603ad782a6de5c40b31dd73fd51646725d

SHA256
56dbbe6eedb45676dde627587576afe27b7aab9c99d5f2a1a33fb321ea8d5348

SHA512
baf59787e04c0688320d451e4b2bc707c3890176c0f3dcd2089d453886362a55bc8ba697ef45e529022d2cf138a91092d7640ba1be10553e70eada21250c2da6

Download Submit
memory/4804-138-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4804-144-0x0000000000400000-0x0000000000402A00-memory.dmp

Filesize
10KB

Download

Analysis

Sharing