e75357a102d8d32b9071917071f0503310d3b84a5ea7634b45927d7b511cff1f

General

Target

0952a9f883147012ec31e69370dd4590_exe32_JC.exe
Size

736KB
MD5

0952a9f883147012ec31e69370dd4590
SHA1

1364fb010aee9d1463693c9a3df72e29500b6456
SHA256

e75357a102d8d32b9071917071f0503310d3b84a5ea7634b45927d7b511cff1f
SHA512

f94d5d94970e520f88eb5b3167780eef962b8e6d7f5d857fd601a40f1a833970eda482b2756ca9f6ab20d4adde3ed1f104e2dae27df4d4f57840c316a186b2a0
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdmdIs7fOtN9i:P1/aGLDCM4D8ayGMZo8/qdf7fO3d4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	knhrm.exe

Loads dropped DLL 2 IoCs

pid	Process
2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe
2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\knhrm.exe"	knhrm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2684	2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe	28
PID 2288 wrote to memory of 2684	2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe	28
PID 2288 wrote to memory of 2684	2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe	28
PID 2288 wrote to memory of 2684	2288	0952a9f883147012ec31e69370dd4590_exe32_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\0952a9f883147012ec31e69370dd4590_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0952a9f883147012ec31e69370dd4590_exe32_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\ProgramData\knhrm.exe
  "C:\ProgramData\knhrm.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe

Filesize
736KB

MD5
d8cb93f2577c65e8a656839d27bec529

SHA1
0b83fb28c1f56afe72bcaae380bd4aa0d1183a02

SHA256
c0898f86779347033c1863d926afbf45f74907ce88e2d85f3231506f8debc8f4

SHA512
1b0007a6696905e608192ac95890e016c673b0fa8c73ddfc42e48a4ebb0c864a0b74d1936be8784524b251ea54c10767a66ec1d5097919a5d28b86867a881669

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\knhrm.exe

Filesize
258KB

MD5
c59b1ebe57c537249e11946ea393673b

SHA1
6a8e7ee34355ee58db3b26a04a6e883e41b6e244

SHA256
1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

SHA512
f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

Download Submit
C:\ProgramData\knhrm.exe

Filesize
258KB

MD5
c59b1ebe57c537249e11946ea393673b

SHA1
6a8e7ee34355ee58db3b26a04a6e883e41b6e244

SHA256
1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

SHA512
f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

Download Submit
C:\ProgramData\knhrm.exe

Filesize
258KB

MD5
c59b1ebe57c537249e11946ea393673b

SHA1
6a8e7ee34355ee58db3b26a04a6e883e41b6e244

SHA256
1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

SHA512
f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

Download Submit
\ProgramData\knhrm.exe

Filesize
258KB

MD5
c59b1ebe57c537249e11946ea393673b

SHA1
6a8e7ee34355ee58db3b26a04a6e883e41b6e244

SHA256
1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

SHA512
f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

Download Submit
\ProgramData\knhrm.exe

Filesize
258KB

MD5
c59b1ebe57c537249e11946ea393673b

SHA1
6a8e7ee34355ee58db3b26a04a6e883e41b6e244

SHA256
1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

SHA512
f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

Download Submit
memory/2288-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2684-49-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2684-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads