c57808a9e2fe1a1e190160d624e9cff6a496ed0d679f7d7a7c0e8760b0b94503

General

Target

1efbc94be630bf1ff280896e81adad1c.exe
Size

158KB
MD5

1efbc94be630bf1ff280896e81adad1c
SHA1

bf1e425c7b25b43301e21bfce5ebe73522a72316
SHA256

c57808a9e2fe1a1e190160d624e9cff6a496ed0d679f7d7a7c0e8760b0b94503
SHA512

1e1c62cf05daac39408d4a7155927e9964052adb369f5551a26134acd4decc13fa4181207bbbabdb4ee9d14585907c402027627a4a684323c3d7a9f44015dc64
SSDEEP

3072:MR/8rqUUfxIdq1n2UuVr2zJxJDwHTkjRzJFkPnHcCzbKtZc:MB85UfxIcpvwHAjRlFkPnHc2utZc

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2980	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1204	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{19350fc2-aa90-f613-4bf0-85f7eee99382}\\n."	1efbc94be630bf1ff280896e81adad1c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{19350fc2-aa90-f613-4bf0-85f7eee99382}\\n."	1efbc94be630bf1ff280896e81adad1c.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	1efbc94be630bf1ff280896e81adad1c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	1efbc94be630bf1ff280896e81adad1c.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{19350fc2-aa90-f613-4bf0-85f7eee99382}\@	1efbc94be630bf1ff280896e81adad1c.exe
File created	C:\Windows\Installer\{19350fc2-aa90-f613-4bf0-85f7eee99382}\n	1efbc94be630bf1ff280896e81adad1c.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	1efbc94be630bf1ff280896e81adad1c.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	1efbc94be630bf1ff280896e81adad1c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	1efbc94be630bf1ff280896e81adad1c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{19350fc2-aa90-f613-4bf0-85f7eee99382}\\n."	1efbc94be630bf1ff280896e81adad1c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{19350fc2-aa90-f613-4bf0-85f7eee99382}\\n."	1efbc94be630bf1ff280896e81adad1c.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\clsid	1efbc94be630bf1ff280896e81adad1c.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2188	1efbc94be630bf1ff280896e81adad1c.exe
2188	1efbc94be630bf1ff280896e81adad1c.exe
2188	1efbc94be630bf1ff280896e81adad1c.exe
2188	1efbc94be630bf1ff280896e81adad1c.exe
2188	1efbc94be630bf1ff280896e81adad1c.exe
2188	1efbc94be630bf1ff280896e81adad1c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	1efbc94be630bf1ff280896e81adad1c.exe
Token: SeDebugPrivilege	2188	1efbc94be630bf1ff280896e81adad1c.exe
Token: SeDebugPrivilege	2188	1efbc94be630bf1ff280896e81adad1c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1204	2188	1efbc94be630bf1ff280896e81adad1c.exe	13
PID 2188 wrote to memory of 1204	2188	1efbc94be630bf1ff280896e81adad1c.exe	13
PID 2188 wrote to memory of 464	2188	1efbc94be630bf1ff280896e81adad1c.exe	2
PID 2188 wrote to memory of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28
PID 2188 wrote to memory of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28
PID 2188 wrote to memory of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28
PID 2188 wrote to memory of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28
PID 2188 wrote to memory of 2980	2188	1efbc94be630bf1ff280896e81adad1c.exe	28

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204
- C:\Users\Admin\AppData\Local\Temp\1efbc94be630bf1ff280896e81adad1c.exe
  "C:\Users\Admin\AppData\Local\Temp\1efbc94be630bf1ff280896e81adad1c.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-11-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/464-18-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1204-3-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/2188-2-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/2188-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2188-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2188-15-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/2188-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads