9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103

General

Target

9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
Size

118KB
MD5

2e4978b633de103215f58e03e6a252f0
SHA1

e3b808f94666ac4d5a37762c65b8f4893259a1af
SHA256

9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103
SHA512

429e5c0831d65eca15beda06f73b3e6eca58e2cbcb2e4f26f956981b228b31be7a1d490f6bf7c2b31573210a1318afc776297b7005952a31499dd1afc072673d
SSDEEP

3072:kLWTEiR+gctabvQuKbtG3ftk3j30lQqAB1kO0exnr:kLWiYTQPG3VQya6O0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1992	jo3rgz87.exe
584	jo3rgz87.exe

Loads dropped DLL 2 IoCs

pid	Process
944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\q92yb = "C:\\Users\\Admin\\AppData\\Roaming\\jo3rgz87.exe"	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1992 set thread context of 584	1992	jo3rgz87.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 1696 wrote to memory of 944	1696	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	27
PID 944 wrote to memory of 1992	944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	28
PID 944 wrote to memory of 1992	944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	28
PID 944 wrote to memory of 1992	944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	28
PID 944 wrote to memory of 1992	944	9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe	28
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29
PID 1992 wrote to memory of 584	1992	jo3rgz87.exe	29

C:\Users\Admin\AppData\Local\Temp\9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
"C:\Users\Admin\AppData\Local\Temp\9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
  C:\Users\Admin\AppData\Local\Temp\9db67aff89e754098befb0610b909fe4d80d939eb6a6e0d90afb11870f04f103.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
    C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
      C:\Users\Admin\AppData\Roaming\jo3rgz87.exe
      4⤵
      Executes dropped EXE
      PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
118KB

MD5
3c35936b142a705f6cba75ac1458fa8c

SHA1
b344cef697425900acce26037c923faa30fc0f63

SHA256
03474c40100e487c682bb1ab7b7e985e66fdded634bd4879f38f11e7beef7141

SHA512
84708f2f98adb7bc8176a45bc8ad8311a69fab038cd3bcc42a3c13d505c8ebfb53e7aa516c807091248297bcbd30a16b1cd0f4bdb71c500a9356aa8481cc3f26

Download Submit
C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
118KB

MD5
3c35936b142a705f6cba75ac1458fa8c

SHA1
b344cef697425900acce26037c923faa30fc0f63

SHA256
03474c40100e487c682bb1ab7b7e985e66fdded634bd4879f38f11e7beef7141

SHA512
84708f2f98adb7bc8176a45bc8ad8311a69fab038cd3bcc42a3c13d505c8ebfb53e7aa516c807091248297bcbd30a16b1cd0f4bdb71c500a9356aa8481cc3f26

Download Submit
C:\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
118KB

MD5
3c35936b142a705f6cba75ac1458fa8c

SHA1
b344cef697425900acce26037c923faa30fc0f63

SHA256
03474c40100e487c682bb1ab7b7e985e66fdded634bd4879f38f11e7beef7141

SHA512
84708f2f98adb7bc8176a45bc8ad8311a69fab038cd3bcc42a3c13d505c8ebfb53e7aa516c807091248297bcbd30a16b1cd0f4bdb71c500a9356aa8481cc3f26

Download Submit
\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
118KB

MD5
3c35936b142a705f6cba75ac1458fa8c

SHA1
b344cef697425900acce26037c923faa30fc0f63

SHA256
03474c40100e487c682bb1ab7b7e985e66fdded634bd4879f38f11e7beef7141

SHA512
84708f2f98adb7bc8176a45bc8ad8311a69fab038cd3bcc42a3c13d505c8ebfb53e7aa516c807091248297bcbd30a16b1cd0f4bdb71c500a9356aa8481cc3f26

Download Submit
\Users\Admin\AppData\Roaming\jo3rgz87.exe

Filesize
118KB

MD5
3c35936b142a705f6cba75ac1458fa8c

SHA1
b344cef697425900acce26037c923faa30fc0f63

SHA256
03474c40100e487c682bb1ab7b7e985e66fdded634bd4879f38f11e7beef7141

SHA512
84708f2f98adb7bc8176a45bc8ad8311a69fab038cd3bcc42a3c13d505c8ebfb53e7aa516c807091248297bcbd30a16b1cd0f4bdb71c500a9356aa8481cc3f26

Download Submit
memory/584-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/584-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-59-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/944-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing