aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52

General

Target

aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
Size

95KB
MD5

5809c8a264cec4fdafd1e2609be7c2d1
SHA1

7e37aeeb13da09f1ae6af6ebacad954b3e9275e2
SHA256

aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52
SHA512

654a3a1e5138331b64cbddc3f20e9decbe1321a8d5dfb2407b8f2414e5c6ccb2195be6c8a8eddfb2a0f72b06400d6e36874f852b109fb78f041273259bc27a57
SSDEEP

1536:ZhA1zUNC143aup/xVl0ghwnUn+mwM/+lNLUsI5MXHTl8cWBb92iyTWQzAaGNI:ZGOCmNJV+tW+g+vUsIOhjM92bLzAtN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	netprotocol.exe
1696	netprotocol.exe

Loads dropped DLL 2 IoCs

pid	Process
776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 1920 set thread context of 1696	1920	netprotocol.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
1920	netprotocol.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 2032 wrote to memory of 776	2032	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	28
PID 776 wrote to memory of 1920	776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	29
PID 776 wrote to memory of 1920	776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	29
PID 776 wrote to memory of 1920	776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	29
PID 776 wrote to memory of 1920	776	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	29
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30
PID 1920 wrote to memory of 1696	1920	netprotocol.exe	30

C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
"C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
  C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
memory/776-63-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/776-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/776-81-0x00000000001B0000-0x00000000001C8000-memory.dmp

Filesize
96KB

Download
memory/776-80-0x00000000001B0000-0x00000000001C8000-memory.dmp

Filesize
96KB

Download
memory/776-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1696-82-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1920-69-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1920-76-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2032-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2032-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2032-62-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2032-54-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing