246bd60202cc0b21921f393259ee9c9e1f3a5d6d2fd0fad9b4adffb47e9b4fab

General

Target

NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Size

3.4MB
MD5

f1f4d22c8966e31b1f63a7d749fb5ac8
SHA1

001fdd25d3f9de8c626c7e4b35b4cd5de32cb31a
SHA256

246bd60202cc0b21921f393259ee9c9e1f3a5d6d2fd0fad9b4adffb47e9b4fab
SHA512

ef35e636f4d3073f8b3de4677c242e1320df5da770b8e1f65f91d2b61d3bae1fc089381a89982b72c0459fd2cd3d96be76a1e668932fff796bf8f421f49a2c56
SSDEEP

24576:TKFq5hkntq5hU6X1q5h3q5h52q5h3q5hL6X1q5h3q5hM5Dgq5h3q5hL6X1q5h3qB:TKJn9646KI6BbazR0vD

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbijgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe

Executes dropped EXE 3 IoCs

pid	Process
1112	Jbijgp32.exe
4872	Kdmlkfjb.exe
4880	Ldikgdpe.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jbijgp32.exe	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
File created	C:\Windows\SysWOW64\Jdiphhpk.dll	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	Kdmlkfjb.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	Kdmlkfjb.exe
File opened for modification	C:\Windows\SysWOW64\Jbijgp32.exe	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
File created	C:\Windows\SysWOW64\Kdmlkfjb.exe	Jbijgp32.exe
File opened for modification	C:\Windows\SysWOW64\Kdmlkfjb.exe	Jbijgp32.exe
File created	C:\Windows\SysWOW64\Fbkcnp32.dll	Jbijgp32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4808	4880	WerFault.exe	90
4472	4880	WerFault.exe	90

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdiphhpk.dll"	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkcnp32.dll"	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbijgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekdaogi.dll"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbijgp32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1112	1128	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe	88
PID 1128 wrote to memory of 1112	1128	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe	88
PID 1128 wrote to memory of 1112	1128	NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe	88
PID 1112 wrote to memory of 4872	1112	Jbijgp32.exe	89
PID 1112 wrote to memory of 4872	1112	Jbijgp32.exe	89
PID 1112 wrote to memory of 4872	1112	Jbijgp32.exe	89
PID 4872 wrote to memory of 4880	4872	Kdmlkfjb.exe	90
PID 4872 wrote to memory of 4880	4872	Kdmlkfjb.exe	90
PID 4872 wrote to memory of 4880	4872	Kdmlkfjb.exe	90
PID 4880 wrote to memory of 4808	4880	Ldikgdpe.exe	96
PID 4880 wrote to memory of 4808	4880	Ldikgdpe.exe	96
PID 4880 wrote to memory of 4808	4880	Ldikgdpe.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f1f4d22c8966e31b1f63a7d749fb5ac8.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\Jbijgp32.exe
  C:\Windows\system32\Jbijgp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\Kdmlkfjb.exe
    C:\Windows\system32\Kdmlkfjb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\SysWOW64\Ldikgdpe.exe
      C:\Windows\system32\Ldikgdpe.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 400
        5⤵
        Program crash
        
        PID:4808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 400
        5⤵
        Program crash
        
        PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4880 -ip 4880
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jbijgp32.exe

Filesize
3.4MB

MD5
9590fd112558ad943deda5a47d22cf09

SHA1
7faf1637102e9e0fa0699cad035962c586efd289

SHA256
cb7e797cb26bcb24aedd3d6711df3cc54a7a21b4cd66001f3d970f706efda459

SHA512
df8ab4084a749a369fa30f98898cebe149b9ea05523b0c0087a8887b623723540b8352ad980c456c664f0452b8a8774dbc839f2b6aadf0a9d66fc6729feab5ed

Download Submit
C:\Windows\SysWOW64\Jbijgp32.exe

Filesize
3.4MB

MD5
9590fd112558ad943deda5a47d22cf09

SHA1
7faf1637102e9e0fa0699cad035962c586efd289

SHA256
cb7e797cb26bcb24aedd3d6711df3cc54a7a21b4cd66001f3d970f706efda459

SHA512
df8ab4084a749a369fa30f98898cebe149b9ea05523b0c0087a8887b623723540b8352ad980c456c664f0452b8a8774dbc839f2b6aadf0a9d66fc6729feab5ed

Download Submit
C:\Windows\SysWOW64\Kdmlkfjb.exe

Filesize
3.4MB

MD5
e2276223d76909b156a7bdabd3b460a5

SHA1
4776b8fea696fb7855c9987413e513ee3a15838f

SHA256
8ca27cbd30447ce18367620aecee04103bba42f3ef20b2823868114539f6d2bb

SHA512
2cc1558043b0607f8f9a16a9b8ec8fedc48f2fd037f6aaa1da67b3db3698329be8696756cb0ce5c1457601054ebb56c24dc2d702fdba1024007b5ad219c3ecfb

Download Submit
C:\Windows\SysWOW64\Kdmlkfjb.exe

Filesize
3.4MB

MD5
e2276223d76909b156a7bdabd3b460a5

SHA1
4776b8fea696fb7855c9987413e513ee3a15838f

SHA256
8ca27cbd30447ce18367620aecee04103bba42f3ef20b2823868114539f6d2bb

SHA512
2cc1558043b0607f8f9a16a9b8ec8fedc48f2fd037f6aaa1da67b3db3698329be8696756cb0ce5c1457601054ebb56c24dc2d702fdba1024007b5ad219c3ecfb

Download Submit
C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
3.4MB

MD5
1ef5bb62bd16b980ec24c3b36b4fbf2d

SHA1
462a6fdd38187687cc9e58afb3e1842fad9491be

SHA256
6a164cad0950e3aa7eb227131cd3767a2034f5a5908d8c2c4f543a27a16f052e

SHA512
ea1a26ec7655a4a3ee9015cd51801caaeb7a3018b38c576644ee74dec431d76cde5abc8a204d6c0bca96df0e093cc40719cb46d11661835d6031da7dff4c70da

Download Submit
C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
3.4MB

MD5
22619f98941a9e276ce3ace576c61fbe

SHA1
56d80b6050e454203a82e0748977e9129fb663f2

SHA256
c8dc9af555672276ef964d56a48c64dbebb49a7a7bb03a7e5a70a11085541dd7

SHA512
a0860d5c26a5a6cfe307224e1f5c55eb2956abbbaa4d2cf838c7f4eb5687159d6cd62cabad81e36acc8f2367fa78b33e70c9df3d3fcfbec3feadf2ee6f41f4a9

Download Submit
memory/1112-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-30-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads