bdd11d08ab41c7aaaf6398a12a2aaac21b1254a8d6140aa7fc6405e802be8a62

General

Target

01ec980eefb52c397090c056a9750046.exe
Size

240KB
MD5

01ec980eefb52c397090c056a9750046
SHA1

a46b271d96183f2ce6cc11f9525ec982ebcd3b1a
SHA256

bdd11d08ab41c7aaaf6398a12a2aaac21b1254a8d6140aa7fc6405e802be8a62
SHA512

bce48d4859b177d24cdcbf9afb308660a8ab1988fc6ae56157bea2d6506e4eadb57b56ae157ca64e5ff7b3cb041f15127a9ac06126916470161175dcc7346143
SSDEEP

6144:gLdRE99cd91iZb3aztAwz3KnIgRqYBldcSKBK7Po:gLdRE99cDAZb3AtAwTKnLRflaSK87

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

01ec980eefb52c397090c056a9750046.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	01ec980eefb52c397090c056a9750046.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

01ec980eefb52c397090c056a9750046.exe01ec980eefb52c397090c056a9750046.exe

description	pid	process	target process
PID 1156 set thread context of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 set thread context of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe

Suspicious use of SetWindowsHookAW 1 IoCs

Processes:

01ec980eefb52c397090c056a9750046.exe

pid process

1156 01ec980eefb52c397090c056a9750046.exe

pid	process
1156	01ec980eefb52c397090c056a9750046.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

01ec980eefb52c397090c056a9750046.exe01ec980eefb52c397090c056a9750046.exe01ec980eefb52c397090c056a9750046.exe

description	pid	process	target process
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 1156 wrote to memory of 2088	1156	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2088 wrote to memory of 2792	2088	01ec980eefb52c397090c056a9750046.exe	01ec980eefb52c397090c056a9750046.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe
PID 2792 wrote to memory of 2764	2792	01ec980eefb52c397090c056a9750046.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe
"C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe
"C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe
C:\Users\Admin\AppData\Local\Temp\01ec980eefb52c397090c056a9750046.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Program Files (x86)\Internet explorer\iexplore.exe
"C:\Program Files (x86)\Internet explorer\iexplore.exe"
4⤵
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2088-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2088-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2088-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2088-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2088-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2792-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-12-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-18-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-16-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-20-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-14-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-24-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-25-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-26-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads