3e882eabeda60213daec46ec4d6c5be39b8146ba5b06e760badb7abadc0b483e

General

Target

0261ec2be5ad8632139e345061952bb8.exe
Size

173KB
MD5

0261ec2be5ad8632139e345061952bb8
SHA1

ac6a4585190de29e00cb55a52ee2371ca4782116
SHA256

3e882eabeda60213daec46ec4d6c5be39b8146ba5b06e760badb7abadc0b483e
SHA512

d01e365f468ccfccd72cc5b834a37a2b4a889b763ecc1011327ec09c70a3cf13ee4b2a74d5338065577144c1eef1616f5dc3fb76dbcfac0066e101c418d089b5
SSDEEP

3072:qAYfreYMiQG4Q9Fuw3UL67mzqXYniwvD5CcKlHL3qOeL91c/:XYyYMxG4k3d7EOYniggDL39

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2732	cmd.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	0261ec2be5ad8632139e345061952bb8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	0261ec2be5ad8632139e345061952bb8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{eff0c3f9-890e-6eae-e5dd-3a8f877feaa7}\\n."	0261ec2be5ad8632139e345061952bb8.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{eff0c3f9-890e-6eae-e5dd-3a8f877feaa7}\@	0261ec2be5ad8632139e345061952bb8.exe
File created	C:\Windows\Installer\{eff0c3f9-890e-6eae-e5dd-3a8f877feaa7}\n	0261ec2be5ad8632139e345061952bb8.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\clsid	0261ec2be5ad8632139e345061952bb8.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	0261ec2be5ad8632139e345061952bb8.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	0261ec2be5ad8632139e345061952bb8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	0261ec2be5ad8632139e345061952bb8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{eff0c3f9-890e-6eae-e5dd-3a8f877feaa7}\\n."	0261ec2be5ad8632139e345061952bb8.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2144	0261ec2be5ad8632139e345061952bb8.exe
2144	0261ec2be5ad8632139e345061952bb8.exe
2144	0261ec2be5ad8632139e345061952bb8.exe
2144	0261ec2be5ad8632139e345061952bb8.exe
2144	0261ec2be5ad8632139e345061952bb8.exe
2144	0261ec2be5ad8632139e345061952bb8.exe
480	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	0261ec2be5ad8632139e345061952bb8.exe
Token: SeDebugPrivilege	2144	0261ec2be5ad8632139e345061952bb8.exe
Token: SeDebugPrivilege	2144	0261ec2be5ad8632139e345061952bb8.exe
Token: SeDebugPrivilege	480	services.exe
Token: SeBackupPrivilege	480	services.exe
Token: SeRestorePrivilege	480	services.exe
Token: SeSecurityPrivilege	480	services.exe
Token: SeTakeOwnershipPrivilege	480	services.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1232	2144	0261ec2be5ad8632139e345061952bb8.exe	10
PID 2144 wrote to memory of 1232	2144	0261ec2be5ad8632139e345061952bb8.exe	10
PID 2144 wrote to memory of 480	2144	0261ec2be5ad8632139e345061952bb8.exe	2
PID 2144 wrote to memory of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28
PID 2144 wrote to memory of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28
PID 2144 wrote to memory of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28
PID 2144 wrote to memory of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28
PID 2144 wrote to memory of 2732	2144	0261ec2be5ad8632139e345061952bb8.exe	28

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\0261ec2be5ad8632139e345061952bb8.exe
  "C:\Users\Admin\AppData\Local\Temp\0261ec2be5ad8632139e345061952bb8.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{eff0c3f9-890e-6eae-e5dd-3a8f877feaa7}\@

Filesize
2KB

MD5
8829a39f31713ca00339bcc0cde862e1

SHA1
a216b2ee3f17fb5636d0668b5a8dea36b55597af

SHA256
27c8292fd036280cb92f4d0d5dcf1430efb9fb5f6dce7d7bb353971694cececf

SHA512
b0bd033ab9022a58e5a4d50643c1d19a9c9f4021fbf6ec2b80ec209817609a9181c4fee82eb98215ac0a2e946be43048271745405eb7cab3e7a074e29473fdea

Download Submit
memory/480-32-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/480-43-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/480-42-0x0000000002D70000-0x0000000002D7F000-memory.dmp

Filesize
60KB

Download
memory/480-28-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/480-33-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/480-34-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/1232-18-0x0000000002D10000-0x0000000002D1C000-memory.dmp

Filesize
48KB

Download
memory/1232-6-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1232-17-0x0000000002D60000-0x0000000002D6F000-memory.dmp

Filesize
60KB

Download
memory/1232-9-0x0000000002D60000-0x0000000002D6F000-memory.dmp

Filesize
60KB

Download
memory/1232-19-0x0000000002D70000-0x0000000002D7F000-memory.dmp

Filesize
60KB

Download
memory/1232-20-0x0000000002D70000-0x0000000002D7F000-memory.dmp

Filesize
60KB

Download
memory/1232-13-0x0000000002D60000-0x0000000002D6F000-memory.dmp

Filesize
60KB

Download
memory/2144-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2144-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2144-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2144-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2144-38-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2144-39-0x0000000000260000-0x000000000028D000-memory.dmp

Filesize
180KB

Download
memory/2144-41-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2144-2-0x0000000000260000-0x000000000028D000-memory.dmp

Filesize
180KB

Download
memory/2144-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads