addfa311eabf3be46876bd0eff80ddd4dd0b6afc505b23f08d40798080f5c537

General

Target

03700cbd2577f4ea42124ae956438f89.exe
Size

26KB
MD5

03700cbd2577f4ea42124ae956438f89
SHA1

6d860e28d28d37897bb8add4e762fc21db149d9e
SHA256

addfa311eabf3be46876bd0eff80ddd4dd0b6afc505b23f08d40798080f5c537
SHA512

9f6d4ed72194b43ebf6c11c0bb390dd66939e0d151f15c375308e674db68942ce2a8277845bf69c07f5e53bb6b4328a191a7f83bbe5b423b210e454b35c686bf
SSDEEP

768:vbwBerYmMSgB/lQZs6gr4R6zKToeGyEY02UmPI5UUPeukukuI:zwBeMlJdoIr4bGyi+rP

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\beep.sys	03700cbd2577f4ea42124ae956438f89.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	03700cbd2577f4ea42124ae956438f89.exe

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2900	MayaBabyMain.exe

Loads dropped DLL 2 IoCs

pid	Process
2056	03700cbd2577f4ea42124ae956438f89.exe
2900	MayaBabyMain.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\me.bat	03700cbd2577f4ea42124ae956438f89.exe
File opened for modification	C:\Windows\SysWOW64\me.bat	attrib.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\MayaBaby\gaga.bat	03700cbd2577f4ea42124ae956438f89.exe
File created	C:\Windows\MayaBaby\MayaBabyDll.dat	MayaBabyMain.exe
File opened for modification	C:\Windows\MayaBaby\MayaBabySYS.dat	MayaBabyMain.exe
File opened for modification	C:\Windows\MayaBaby\MayaBabyDll.dat	MayaBabyMain.exe
File created	C:\Windows\MayaBaby\MayaBabyDll.dat	03700cbd2577f4ea42124ae956438f89.exe
File created	C:\Windows\MayaBaby\MayaBabySYS.dat	03700cbd2577f4ea42124ae956438f89.exe
File opened for modification	C:\Windows\MayaBaby\MayaBabyDll.dat	03700cbd2577f4ea42124ae956438f89.exe
File opened for modification	C:\Windows\MayaBaby\MayaBabySYS.dat	03700cbd2577f4ea42124ae956438f89.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2900	MayaBabyMain.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2056	03700cbd2577f4ea42124ae956438f89.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe
2900	MayaBabyMain.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	03700cbd2577f4ea42124ae956438f89.exe
Token: SeDebugPrivilege	2900	MayaBabyMain.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2756	2056	03700cbd2577f4ea42124ae956438f89.exe	28
PID 2056 wrote to memory of 2756	2056	03700cbd2577f4ea42124ae956438f89.exe	28
PID 2056 wrote to memory of 2756	2056	03700cbd2577f4ea42124ae956438f89.exe	28
PID 2056 wrote to memory of 2756	2056	03700cbd2577f4ea42124ae956438f89.exe	28
PID 2756 wrote to memory of 2788	2756	NET.exe	30
PID 2756 wrote to memory of 2788	2756	NET.exe	30
PID 2756 wrote to memory of 2788	2756	NET.exe	30
PID 2756 wrote to memory of 2788	2756	NET.exe	30
PID 2056 wrote to memory of 2568	2056	03700cbd2577f4ea42124ae956438f89.exe	31
PID 2056 wrote to memory of 2568	2056	03700cbd2577f4ea42124ae956438f89.exe	31
PID 2056 wrote to memory of 2568	2056	03700cbd2577f4ea42124ae956438f89.exe	31
PID 2056 wrote to memory of 2568	2056	03700cbd2577f4ea42124ae956438f89.exe	31
PID 2568 wrote to memory of 2724	2568	NET.exe	33
PID 2568 wrote to memory of 2724	2568	NET.exe	33
PID 2568 wrote to memory of 2724	2568	NET.exe	33
PID 2568 wrote to memory of 2724	2568	NET.exe	33
PID 2900 wrote to memory of 596	2900	MayaBabyMain.exe	26
PID 2056 wrote to memory of 2616	2056	03700cbd2577f4ea42124ae956438f89.exe	36
PID 2056 wrote to memory of 2616	2056	03700cbd2577f4ea42124ae956438f89.exe	36
PID 2056 wrote to memory of 2616	2056	03700cbd2577f4ea42124ae956438f89.exe	36
PID 2056 wrote to memory of 2616	2056	03700cbd2577f4ea42124ae956438f89.exe	36
PID 2616 wrote to memory of 2108	2616	cmd.exe	37
PID 2616 wrote to memory of 2108	2616	cmd.exe	37
PID 2616 wrote to memory of 2108	2616	cmd.exe	37
PID 2616 wrote to memory of 2108	2616	cmd.exe	37

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2108	attrib.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

C:\Users\Admin\AppData\Local\Temp\03700cbd2577f4ea42124ae956438f89.exe
"C:\Users\Admin\AppData\Local\Temp\03700cbd2577f4ea42124ae956438f89.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\NET.exe
  NET STOP Beep
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP Beep
    3⤵
    PID:2788
- C:\Windows\SysWOW64\NET.exe
  NET START Beep
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 START Beep
    3⤵
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\me.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h -s -r -a C:\Windows\system32\me.bat
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:2108

C:\Windows\MayaBaby\MayaBabyMain.exe
C:\Windows\MayaBaby\MayaBabyMain.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MayaBaby\MayaBabyMain.exe

Filesize
26KB

MD5
03700cbd2577f4ea42124ae956438f89

SHA1
6d860e28d28d37897bb8add4e762fc21db149d9e

SHA256
addfa311eabf3be46876bd0eff80ddd4dd0b6afc505b23f08d40798080f5c537

SHA512
9f6d4ed72194b43ebf6c11c0bb390dd66939e0d151f15c375308e674db68942ce2a8277845bf69c07f5e53bb6b4328a191a7f83bbe5b423b210e454b35c686bf

Download Submit
C:\Windows\SysWOW64\drivers\beep.sys

Filesize
4KB

MD5
34b58d3df160986141117799dd8920c9

SHA1
67c3725081faa5d20d7217ee79151867f3703f81

SHA256
b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8

SHA512
1289e14c83ff8da9680d955101fbca7301666a10714c22bad0b146d15ce09aa53e04611d5380548c426ee8162482f31e38e0e55c115fa9aac822c32cce1678f0

Download Submit
C:\Windows\SysWOW64\me.bat

Filesize
130B

MD5
bb7c20ec76af354aede4ff2144151631

SHA1
aac9ac901b7739b44a974384b0dcf57e227154c1

SHA256
cfe9177f7001f8027de60bb3e87b64ead92fe0ae0d6ccb00f9e96bf10cbd4b30

SHA512
605dc2620eb4ee691f6c8d0d947a82525ced4d32b13a2c121f22177910bf33905ed4ba96a27fafd74cb455092537c361290b3639ec49678a43f35573869fe609

Download Submit
\Windows\MayaBaby\MayaBabyDll.dat

Filesize
18KB

MD5
8908f4012fbb197175e1f59f20385a33

SHA1
bdb5b3226d5edfa9de5f22fbd457e5ab6d62d10b

SHA256
2389c45e0c6c0784a131ab2f4c5c794a06d8630f48ff14ed223b06a6d3f99034

SHA512
a73894a22bd6489dc455bc45c5bf8e094ed7fb2cd477b26810d0ede4af8862be1946a27195e74f50571f41c2b6e9d36b8c5a178b6b01a9e0f66f32b66064c931

Download Submit
memory/596-20-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2056-9-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2056-28-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2900-18-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2900-21-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing