be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad

General

Target

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Size

4.7MB
MD5

40fecdacb422170fabbcd933849ae6c7
SHA1

3d8ba385aba588116943ec065337adcdf5930c4b
SHA256

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad
SHA512

d375f586d5c7357a3062d891107882cc539a2954b293e2d5e36b87a254c51a442f264f454c282d4ca8313a99d4b7eba80e2c47fb4341234a7f2719b0e4df2a6c
SSDEEP

98304:DnINcPGFJe1J3Yb0y/tqARRRRRAjddmYcOIG4hVTPQMXEvI4vM:zUUGDe1J9Wsvc1GWxXuI0M

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

description ioc process

File opened for modification C:\Windows\ebest.ini be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\ebest.ini	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

Modifies registry class 9 IoCs

Processes:

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\ = "xadtweblogin Protocol"	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe,1"	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\shell	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\shell\open	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe\" \"%1\""	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\URL Protocol	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\DefaultIcon	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xadtweblogin\shell\open\command	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

pid	process
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

pid	process
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
1736	be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe

C:\Users\Admin\AppData\Local\Temp\be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe
"C:\Users\Admin\AppData\Local\Temp\be59958d63d0e11d1bf9528d4cfe43b852729d4fe49eb0fb64fcf2566be2bdad.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ebest.ini
Filesize
85B

MD5
de7c394a7582f9be6e4c7495cb8cfaec

SHA1
b1d2f4bc738d68b5e17d6366a6e001a023d3a73d

SHA256
783fdbfd79e22c6bf2eef0ab6905c4c79796d6a4ffa553e656e36457ffdcdab1

SHA512
6db12cd4e77cca89ead788a9deb6cb17a8d877f07e671e79950af7fd4697f8030a4128e6f5a69673d742a00240f2f1d741318e7d542cd0583df9648a290a4588

Download Submit
memory/1736-54-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-55-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-56-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-57-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-58-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-59-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1736-66-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-68-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1736-80-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download
memory/1736-83-0x0000000000400000-0x00000000017F9000-memory.dmp

Filesize
20.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads