9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2

General

Target

9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2.exe
Size

2.5MB
MD5

fda40c5bbe6b2e0e2c5e0a5722c9d9d7
SHA1

ee883b9da5e1c9d1d1da4565c904636f9f2a5042
SHA256

9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2
SHA512

2ff0a82f5f779bee78c72eacb3ae2db039dbb7334397e7a2ccbe9f0035ce7a32548e4b131496fadc3d05b02785bd03467dd9d3b061f16b88f7ab6e8d1841c713
SSDEEP

49152:2Ogo4SoH0OZ61PCEb5bOmGWsbdbQPWhHLCPjcW4:2OFJtCEdbOmBsbdbrhHWrcW4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3016	IntelUpdate.exe
2720	IntelUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2628	taskeng.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2604	9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2.exe
2604	9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2.exe
3016	IntelUpdate.exe
3016	IntelUpdate.exe
3016	IntelUpdate.exe
3016	IntelUpdate.exe
2720	IntelUpdate.exe
2720	IntelUpdate.exe
2720	IntelUpdate.exe
2720	IntelUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	IntelUpdate.exe
Token: SeDebugPrivilege	3016	IntelUpdate.exe
Token: SeDebugPrivilege	2720	IntelUpdate.exe
Token: SeDebugPrivilege	2720	IntelUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2720	2628	taskeng.exe	30
PID 2628 wrote to memory of 2720	2628	taskeng.exe	30
PID 2628 wrote to memory of 2720	2628	taskeng.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2.exe
"C:\Users\Admin\AppData\Local\Temp\9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604
- \??\c:\IntelUpdate\IntelUpdate.exe
  \??\c:\IntelUpdate\IntelUpdate.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016

C:\Windows\system32\taskeng.exe
taskeng.exe {F3B9072F-6DE4-482E-9714-3C517B895263} S-1-5-21-3849525425-30183055-657688904-1000:KGPMNUDG\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628
- \??\c:\IntelUpdate\IntelUpdate.exe
  c:\IntelUpdate\IntelUpdate.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelUpdate\IntelUpdate.exe

Filesize
2.5MB

MD5
fda40c5bbe6b2e0e2c5e0a5722c9d9d7

SHA1
ee883b9da5e1c9d1d1da4565c904636f9f2a5042

SHA256
9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2

SHA512
2ff0a82f5f779bee78c72eacb3ae2db039dbb7334397e7a2ccbe9f0035ce7a32548e4b131496fadc3d05b02785bd03467dd9d3b061f16b88f7ab6e8d1841c713

Download Submit
C:\IntelUpdate\IntelUpdate.exe

Filesize
2.5MB

MD5
fda40c5bbe6b2e0e2c5e0a5722c9d9d7

SHA1
ee883b9da5e1c9d1d1da4565c904636f9f2a5042

SHA256
9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2

SHA512
2ff0a82f5f779bee78c72eacb3ae2db039dbb7334397e7a2ccbe9f0035ce7a32548e4b131496fadc3d05b02785bd03467dd9d3b061f16b88f7ab6e8d1841c713

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68F2.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
\IntelUpdate\IntelUpdate.exe

Filesize
2.5MB

MD5
fda40c5bbe6b2e0e2c5e0a5722c9d9d7

SHA1
ee883b9da5e1c9d1d1da4565c904636f9f2a5042

SHA256
9eb24453f78c6de1dcc9f10926ddb38415b0a114ae36fbda1dc3be45e44164a2

SHA512
2ff0a82f5f779bee78c72eacb3ae2db039dbb7334397e7a2ccbe9f0035ce7a32548e4b131496fadc3d05b02785bd03467dd9d3b061f16b88f7ab6e8d1841c713

Download Submit
memory/2720-11-0x000007FEFD4A0000-0x000007FEFD4A1000-memory.dmp

Filesize
4KB

Download
memory/2720-8-0x000007FEF3C90000-0x000007FEF52BC000-memory.dmp

Filesize
22.2MB

Download
memory/2720-9-0x000007FEF3C90000-0x000007FEF52BC000-memory.dmp

Filesize
22.2MB

Download
memory/2720-10-0x000007FEFD490000-0x000007FEFD491000-memory.dmp

Filesize
4KB

Download
memory/2720-28-0x0000000003760000-0x0000000003D48000-memory.dmp

Filesize
5.9MB

Download
memory/2720-29-0x0000000003760000-0x0000000003D48000-memory.dmp

Filesize
5.9MB

Download
memory/2720-30-0x0000000003760000-0x0000000003D48000-memory.dmp

Filesize
5.9MB

Download
memory/2720-31-0x0000000003760000-0x0000000003D48000-memory.dmp

Filesize
5.9MB

Download
memory/3016-4-0x000007FEFD490000-0x000007FEFD491000-memory.dmp

Filesize
4KB

Download
memory/3016-3-0x000007FEF52C0000-0x000007FEF68EC000-memory.dmp

Filesize
22.2MB

Download
memory/3016-2-0x000007FEF52C0000-0x000007FEF68EC000-memory.dmp

Filesize
22.2MB

Download

Analysis

Sharing