56c1a28f84e286c53178a2d631a1df4409bdb5fa0c0452a244ea9defc4d6d2ad

General

Target

20b54556a3a3101e060d2d04621b33d5.exe
Size

157KB
MD5

20b54556a3a3101e060d2d04621b33d5
SHA1

a18f78bc460e15ce2f98fae4423d4856728a3a31
SHA256

56c1a28f84e286c53178a2d631a1df4409bdb5fa0c0452a244ea9defc4d6d2ad
SHA512

59ce38cd81a14d9a76e671dc6685702a458d2dd6021ae95f18e123782e79c0ba31356426f694b3ee7c31e16953f52afc4091aeef19367a3ef86d2b857ad5ff0b
SSDEEP

3072:waFoV8RSJAm1gJ5LHRpL48eSURN5QCwJ9OcMkEeIhvryajU0of3Qw4+:waKAm1gfHR5nenTcXIH1w4

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

Explorer.EXE

pid process

3308 Explorer.EXE

pid	process
3308	Explorer.EXE

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

20b54556a3a3101e060d2d04621b33d5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	20b54556a3a3101e060d2d04621b33d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	20b54556a3a3101e060d2d04621b33d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2398549320-3657759451-817663969-1000\\$d7362a29d498cbe6f160f22253cfe716\\n."	20b54556a3a3101e060d2d04621b33d5.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Modifies registry class 5 IoCs

Processes:

20b54556a3a3101e060d2d04621b33d5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\clsid	20b54556a3a3101e060d2d04621b33d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	20b54556a3a3101e060d2d04621b33d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	20b54556a3a3101e060d2d04621b33d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	20b54556a3a3101e060d2d04621b33d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2398549320-3657759451-817663969-1000\\$d7362a29d498cbe6f160f22253cfe716\\n."	20b54556a3a3101e060d2d04621b33d5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

20b54556a3a3101e060d2d04621b33d5.exeExplorer.EXE

pid	process
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3352	20b54556a3a3101e060d2d04621b33d5.exe
3308	Explorer.EXE
3308	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

20b54556a3a3101e060d2d04621b33d5.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3352	20b54556a3a3101e060d2d04621b33d5.exe
Token: SeDebugPrivilege	3352	20b54556a3a3101e060d2d04621b33d5.exe
Token: SeDebugPrivilege	3352	20b54556a3a3101e060d2d04621b33d5.exe
Token: SeDebugPrivilege	3308	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3308 Explorer.EXE

pid	process
3308	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

20b54556a3a3101e060d2d04621b33d5.exe

description	pid	process	target process
PID 3352 wrote to memory of 3308	3352	20b54556a3a3101e060d2d04621b33d5.exe	Explorer.EXE
PID 3352 wrote to memory of 3308	3352	20b54556a3a3101e060d2d04621b33d5.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3308

C:\Users\Admin\AppData\Local\Temp\20b54556a3a3101e060d2d04621b33d5.exe
"C:\Users\Admin\AppData\Local\Temp\20b54556a3a3101e060d2d04621b33d5.exe"
2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2398549320-3657759451-817663969-1000\$d7362a29d498cbe6f160f22253cfe716\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/3308-10-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3308-14-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3352-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3352-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3352-2-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3352-3-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3352-4-0x00000000005F0000-0x000000000062A000-memory.dmp

Filesize
232KB

Download
memory/3352-5-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3352-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3352-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3352-13-0x00000000005F0000-0x000000000062A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads