edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622

General

Target

edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
Size

366KB
MD5

7ddc9d7e7d73ac709c5d549fda478360
SHA1

f786cc4bf8db1660331fbd85410fdb3d20e0939a
SHA256

edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622
SHA512

06475435f7744d047365312189c4957289d7559bac2dfe39c0489cfe19caf569bb10693c76bc363557068b3c69adebbc7793cea2327f88361a636f6c51b4828c
SSDEEP

6144:4f+zrJY+/vLTHu4GATr9eRjVla9qqz3xKrBcZmGizBJhtb1xbKIAQMkigXf:nmqOw9eNVw9qq3Si8GUTb5Mkiuf

Score

8^/10

persistence

Malware Config

Signatures

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1688	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1700	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	27
PID 1736 wrote to memory of 1700	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	27
PID 1736 wrote to memory of 1700	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	27
PID 1736 wrote to memory of 1700	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	27
PID 1736 wrote to memory of 1772	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	29
PID 1736 wrote to memory of 1772	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	29
PID 1736 wrote to memory of 1772	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	29
PID 1736 wrote to memory of 1772	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	29
PID 1736 wrote to memory of 564	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	30
PID 1736 wrote to memory of 564	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	30
PID 1736 wrote to memory of 564	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	30
PID 1736 wrote to memory of 564	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	30
PID 1736 wrote to memory of 1688	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	35
PID 1736 wrote to memory of 1688	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	35
PID 1736 wrote to memory of 1688	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	35
PID 1736 wrote to memory of 1688	1736	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	35

C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
"C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:1700
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:1772
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM javasq2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-70-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-74-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-58-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-60-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1736-62-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-61-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-63-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1736-64-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-73-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-66-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-67-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-68-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-69-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-54-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-59-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-71-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-65-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-72-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-75-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-76-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-77-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-78-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-79-0x0000000000462000-0x0000000000464800-memory.dmp

Filesize
10KB

Download
memory/1736-80-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1736-81-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-82-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1736-57-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-88-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1736-56-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-55-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/1736-87-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing