aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52

General

Target

aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
Size

95KB
MD5

5809c8a264cec4fdafd1e2609be7c2d1
SHA1

7e37aeeb13da09f1ae6af6ebacad954b3e9275e2
SHA256

aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52
SHA512

654a3a1e5138331b64cbddc3f20e9decbe1321a8d5dfb2407b8f2414e5c6ccb2195be6c8a8eddfb2a0f72b06400d6e36874f852b109fb78f041273259bc27a57
SSDEEP

1536:ZhA1zUNC143aup/xVl0ghwnUn+mwM/+lNLUsI5MXHTl8cWBb92iyTWQzAaGNI:ZGOCmNJV+tW+g+vUsIOhjM92bLzAtN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3128	netprotocol.exe
4732	netprotocol.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 3128 set thread context of 4732	3128	netprotocol.exe	85

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
3128	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 5060 wrote to memory of 1524	5060	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	81
PID 1524 wrote to memory of 3128	1524	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	84
PID 1524 wrote to memory of 3128	1524	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	84
PID 1524 wrote to memory of 3128	1524	aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe	84
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85
PID 3128 wrote to memory of 4732	3128	netprotocol.exe	85

C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
"C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
  C:\Users\Admin\AppData\Local\Temp\aa3f4afcaf15d8bee98661477621b34e1ffb65518ed7d957bee111b5268efa52.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
95KB

MD5
0b71b52c677decb5ac200966cd3534a5

SHA1
a368aac511b0be81e1b8cadbcab040cf66dad88b

SHA256
fb39b824fa445ca8c895d83d570da60cb543434ffe1fbc106e64e9b25bfec7c3

SHA512
3670b62c1b0a88d915e29c2275b385361209616f4061bd14be06f58b5f5444fbdd7344572df98399548913aeb007066a1225a20d0caf2df9a8f443762ecdb8ac

Download Submit
memory/1524-155-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-139-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-141-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3128-146-0x0000000074E60000-0x0000000074FBD000-memory.dmp

Filesize
1.4MB

Download
memory/3128-153-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4732-152-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4732-154-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5060-140-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5060-134-0x0000000074E60000-0x0000000074FBD000-memory.dmp

Filesize
1.4MB

Download
memory/5060-133-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing