d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3

General

Target

d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe
Size

315KB
MD5

7aec8b51a8419e9c82d7db544ee5116e
SHA1

522aa0a1b4bdb644984256ece94e8fbe25e6b885
SHA256

d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3
SHA512

faf449499798101706717df91b7385638edf1c7a57da41acc93031b527fdf8f44d12d281a44f589b59fb47fa086ef227b1d55ac595b4fe215173dd9a16657d3d
SSDEEP

6144:e1gx6Xbs2bigdxOy270zEHmKC4RGkhSGhPCqQSU3xvn+Fty:e1gx6g2bigdcgy5C4RDfhP0vn+/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
904	F4D55F6500014973000C06C9B4EB2331.exe

Deletes itself 1 IoCs

pid	Process
904	F4D55F6500014973000C06C9B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe
1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C06C9B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C06C9B4EB2331\\F4D55F6500014973000C06C9B4EB2331.exe"	F4D55F6500014973000C06C9B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe
904	F4D55F6500014973000C06C9B4EB2331.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe
Token: SeDebugPrivilege	904	F4D55F6500014973000C06C9B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 904	1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe	26
PID 1160 wrote to memory of 904	1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe	26
PID 1160 wrote to memory of 904	1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe	26
PID 1160 wrote to memory of 904	1160	d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe	26

C:\Users\Admin\AppData\Local\Temp\d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe
"C:\Users\Admin\AppData\Local\Temp\d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe
  "C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe

Filesize
315KB

MD5
7aec8b51a8419e9c82d7db544ee5116e

SHA1
522aa0a1b4bdb644984256ece94e8fbe25e6b885

SHA256
d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3

SHA512
faf449499798101706717df91b7385638edf1c7a57da41acc93031b527fdf8f44d12d281a44f589b59fb47fa086ef227b1d55ac595b4fe215173dd9a16657d3d

Download Submit
C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe

Filesize
315KB

MD5
7aec8b51a8419e9c82d7db544ee5116e

SHA1
522aa0a1b4bdb644984256ece94e8fbe25e6b885

SHA256
d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3

SHA512
faf449499798101706717df91b7385638edf1c7a57da41acc93031b527fdf8f44d12d281a44f589b59fb47fa086ef227b1d55ac595b4fe215173dd9a16657d3d

Download Submit
\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe

Filesize
315KB

MD5
7aec8b51a8419e9c82d7db544ee5116e

SHA1
522aa0a1b4bdb644984256ece94e8fbe25e6b885

SHA256
d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3

SHA512
faf449499798101706717df91b7385638edf1c7a57da41acc93031b527fdf8f44d12d281a44f589b59fb47fa086ef227b1d55ac595b4fe215173dd9a16657d3d

Download Submit
\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe

Filesize
315KB

MD5
7aec8b51a8419e9c82d7db544ee5116e

SHA1
522aa0a1b4bdb644984256ece94e8fbe25e6b885

SHA256
d35ca88b8ebcaa54512202c0f06074c3632276c945c70d2fc2a4d98475132cc3

SHA512
faf449499798101706717df91b7385638edf1c7a57da41acc93031b527fdf8f44d12d281a44f589b59fb47fa086ef227b1d55ac595b4fe215173dd9a16657d3d

Download Submit
memory/904-62-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/904-63-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1160-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1160-55-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1160-56-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1160-65-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing