55e03529866e7458fd208eaac1358146e547c98eac8c32c66b6aff7d861cd05f

General

Target

6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Size

204KB
MD5

6cd5f604e6bd9f59fa893f2f8d8e962c
SHA1

f1ba39d89a0f93079ae8018e6f9e197dfc216a60
SHA256

55e03529866e7458fd208eaac1358146e547c98eac8c32c66b6aff7d861cd05f
SHA512

e8f58057b479dfba5754191fb14d4c8cbffda40b45cbd98d1ca3e43353ebbbc9ca93dba364107b866ec5ddd633cd15bc685a27e286dd3260395ef247ab69a952
SSDEEP

6144:gyrmrnlhNTXStXs+Ngtg5yAg4duyMDHOq8Wy9993:g5rfNTcXgIkpyMHOq8J

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2120	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1284	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2444714103-3190537498-3629098939-1000\\$c719ed21c9c55e4aa8d8a009c091417f\\n."	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$c719ed21c9c55e4aa8d8a009c091417f\\n."	6cd5f604e6bd9f59fa893f2f8d8e962c.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$c719ed21c9c55e4aa8d8a009c091417f\\n."	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\clsid	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2444714103-3190537498-3629098939-1000\\$c719ed21c9c55e4aa8d8a009c091417f\\n."	6cd5f604e6bd9f59fa893f2f8d8e962c.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
464	services.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Token: SeDebugPrivilege	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Token: SeDebugPrivilege	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe
Token: SeDebugPrivilege	464	services.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1284	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	7
PID 3028 wrote to memory of 1284	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	7
PID 3028 wrote to memory of 464	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	22
PID 3028 wrote to memory of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28
PID 3028 wrote to memory of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28
PID 3028 wrote to memory of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28
PID 3028 wrote to memory of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28
PID 3028 wrote to memory of 2120	3028	6cd5f604e6bd9f59fa893f2f8d8e962c.exe	28

C:\Users\Admin\AppData\Local\Temp\6cd5f604e6bd9f59fa893f2f8d8e962c.exe
"C:\Users\Admin\AppData\Local\Temp\6cd5f604e6bd9f59fa893f2f8d8e962c.exe"
1⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:2120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-18\$c719ed21c9c55e4aa8d8a009c091417f\@

Filesize
2KB

MD5
9ba23feda6fbb5592a12e8270c51b180

SHA1
03bc459e5de084251f25d000e5717f065822f0d5

SHA256
0d6d07ae3adaf6b754a0b142bb0d52b6c0d2c28a7954ab0d689bfcd2c9a28cae

SHA512
85bdc6c5af93b32b863aa8b852090694f8615f021d27c28758bc25bee5c6d56240d30c7d973e7b052a1817de99b099bd23ac2c36027e194f63fbe87ca5638b63

Download Submit
C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\$c719ed21c9c55e4aa8d8a009c091417f\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/464-13-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/464-22-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1284-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3028-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3028-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3028-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3028-19-0x0000000000270000-0x00000000002AC000-memory.dmp

Filesize
240KB

Download
memory/3028-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3028-2-0x0000000000270000-0x00000000002AC000-memory.dmp

Filesize
240KB

Download
memory/3028-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads