ae45ff562f0a6d3a824af35eb1a5304b6ede33d4a61c68acc9ccaf55837e070c

General

Target

04244d8dda4e40de6dbdc1b66ec403e3.exe
Size

552KB
MD5

04244d8dda4e40de6dbdc1b66ec403e3
SHA1

c213a99619dc3f93668c576a4c48338552aadeca
SHA256

ae45ff562f0a6d3a824af35eb1a5304b6ede33d4a61c68acc9ccaf55837e070c
SHA512

b43243c1ae8c29abaa0ac0f8b874ef9d15c3fd07642ffedfd58603984844db2e5a85b5442384ec65c35452c15710379add4ad2eafd6c25ef0fa988e26b907a52
SSDEEP

12288:BfH2pohMieNkyrKD7yyTwhVKuO3BnGTexV:dWWNikya750chGT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	RemoteAbc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	RemoteAbc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RemoteAbc.exe	04244d8dda4e40de6dbdc1b66ec403e3.exe
File opened for modification	C:\Windows\RemoteAbc.exe	04244d8dda4e40de6dbdc1b66ec403e3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000d0316d53bd3ada01	RemoteAbc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RemoteAbc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000106f6853bd3ada01	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000d0316d53bd3ada01	RemoteAbc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000070d06a53bd3ada01	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000070d06a53bd3ada01	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000d0316d53bd3ada01	RemoteAbc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030936f53bd3ada01	RemoteAbc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	RemoteAbc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	RemoteAbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	RemoteAbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2744	1988	04244d8dda4e40de6dbdc1b66ec403e3.exe	30
PID 1988 wrote to memory of 2744	1988	04244d8dda4e40de6dbdc1b66ec403e3.exe	30
PID 1988 wrote to memory of 2744	1988	04244d8dda4e40de6dbdc1b66ec403e3.exe	30
PID 1988 wrote to memory of 2744	1988	04244d8dda4e40de6dbdc1b66ec403e3.exe	30
PID 2324 wrote to memory of 2748	2324	RemoteAbc.exe	29
PID 2324 wrote to memory of 2748	2324	RemoteAbc.exe	29
PID 2324 wrote to memory of 2748	2324	RemoteAbc.exe	29
PID 2324 wrote to memory of 2748	2324	RemoteAbc.exe	29

C:\Users\Admin\AppData\Local\Temp\04244d8dda4e40de6dbdc1b66ec403e3.exe
"C:\Users\Admin\AppData\Local\Temp\04244d8dda4e40de6dbdc1b66ec403e3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\9446.bat
  2⤵
  - Deletes itself
  PID:2744

C:\Windows\RemoteAbc.exe
C:\Windows\RemoteAbc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 111
  2⤵
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9446.bat

Filesize
198B

MD5
8a5a978e7e7466eb36c37b6872924d36

SHA1
3e49cc91fbb0694aba840d424ad749bfce0b3269

SHA256
609c9d1e5def52bd082098f979d71681c8916f5d130b0fe3f051f89bd56536e9

SHA512
e8746ba00d5fa9e3fe480e4fcec24ecb48671ba28eec18df6ba85f019069529431ec1d59dc523cdf8e527a72bc01b4f8f54a0780b9a13184599f28c2da7c9778

Download Submit
C:\Windows\RemoteAbc.exe

Filesize
552KB

MD5
04244d8dda4e40de6dbdc1b66ec403e3

SHA1
c213a99619dc3f93668c576a4c48338552aadeca

SHA256
ae45ff562f0a6d3a824af35eb1a5304b6ede33d4a61c68acc9ccaf55837e070c

SHA512
b43243c1ae8c29abaa0ac0f8b874ef9d15c3fd07642ffedfd58603984844db2e5a85b5442384ec65c35452c15710379add4ad2eafd6c25ef0fa988e26b907a52

Download Submit
memory/1988-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1988-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2324-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2324-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2324-18-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2324-20-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2324-24-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2324-28-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing