a13c5b159b96a1a270a260617edce66c7a13cdd85ee3406032c25cdf1b3bf669

General

Target

09acbc29a773770217696c4ff0e96a45.exe
Size

92KB
MD5

09acbc29a773770217696c4ff0e96a45
SHA1

21a967bdcefa1ce3d2df38d7bf426ac2cec452db
SHA256

a13c5b159b96a1a270a260617edce66c7a13cdd85ee3406032c25cdf1b3bf669
SHA512

be2f7b817b13083323d7fbc67a42fe6d65766b64503a2361108a8856396a7aae863445d6e47c624603f9348ca68da3a8c758592bc01b7e22773436d7e23b7d97
SSDEEP

1536:MpuOO/aZ4LR8LbtoUVuRG5etgBaxXmB+EoC+1xv9tqGNiNW0Ne+zYJXza:MpPO/xLR8LbtVIAeCoC+D10NWy0Xu

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2724 netsh.exe

pid	process
2724	netsh.exe

Drops startup file 4 IoCs

Processes:

09acbc29a773770217696c4ff0e96a45.exevqauxh.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teqnk.exe	09acbc29a773770217696c4ff0e96a45.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teqnk.exe	09acbc29a773770217696c4ff0e96a45.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teqnk.exe	vqauxh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teqnk.exe	vqauxh.exe

Executes dropped EXE 2 IoCs

Processes:

vqauxh.exevqauxh.exe

pid process

2776 vqauxh.exe
2612 vqauxh.exe
Loads dropped DLL 2 IoCs

Processes:

09acbc29a773770217696c4ff0e96a45.exevqauxh.exe

pid process

2304 09acbc29a773770217696c4ff0e96a45.exe
2776 vqauxh.exe

pid	process
2776	vqauxh.exe
2612	vqauxh.exe

pid	process
2304	09acbc29a773770217696c4ff0e96a45.exe
2776	vqauxh.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vqauxh.exe09acbc29a773770217696c4ff0e96a45.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdoepxud = "C:\\Users\\Admin\\AppData\\Local\\vqauxh.exe"	vqauxh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdoepxud = "C:\\Users\\Admin\\AppData\\Local\\vqauxh.exe"	vqauxh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdoepxud = "C:\\Users\\Admin\\AppData\\Local\\vqauxh.exe"	09acbc29a773770217696c4ff0e96a45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdoepxud = "C:\\Users\\Admin\\AppData\\Local\\vqauxh.exe"	09acbc29a773770217696c4ff0e96a45.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

09acbc29a773770217696c4ff0e96a45.exevqauxh.exe

description	pid	process	target process
PID 2932 set thread context of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2776 set thread context of 2612	2776	vqauxh.exe	vqauxh.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

09acbc29a773770217696c4ff0e96a45.exe09acbc29a773770217696c4ff0e96a45.exevqauxh.exe

description	pid	process	target process
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2932 wrote to memory of 2304	2932	09acbc29a773770217696c4ff0e96a45.exe	09acbc29a773770217696c4ff0e96a45.exe
PID 2304 wrote to memory of 2724	2304	09acbc29a773770217696c4ff0e96a45.exe	netsh.exe
PID 2304 wrote to memory of 2724	2304	09acbc29a773770217696c4ff0e96a45.exe	netsh.exe
PID 2304 wrote to memory of 2724	2304	09acbc29a773770217696c4ff0e96a45.exe	netsh.exe
PID 2304 wrote to memory of 2724	2304	09acbc29a773770217696c4ff0e96a45.exe	netsh.exe
PID 2304 wrote to memory of 2776	2304	09acbc29a773770217696c4ff0e96a45.exe	vqauxh.exe
PID 2304 wrote to memory of 2776	2304	09acbc29a773770217696c4ff0e96a45.exe	vqauxh.exe
PID 2304 wrote to memory of 2776	2304	09acbc29a773770217696c4ff0e96a45.exe	vqauxh.exe
PID 2304 wrote to memory of 2776	2304	09acbc29a773770217696c4ff0e96a45.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe
PID 2776 wrote to memory of 2612	2776	vqauxh.exe	vqauxh.exe

C:\Users\Admin\AppData\Local\Temp\09acbc29a773770217696c4ff0e96a45.exe
"C:\Users\Admin\AppData\Local\Temp\09acbc29a773770217696c4ff0e96a45.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\09acbc29a773770217696c4ff0e96a45.exe
C:\Users\Admin\AppData\Local\Temp\09acbc29a773770217696c4ff0e96a45.exe
2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram 1.exe 1 ENABLE
3⤵
- Modifies Windows Firewall
PID:2724

C:\Users\Admin\AppData\Local\vqauxh.exe
"C:\Users\Admin\AppData\Local\vqauxh.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\vqauxh.exe
C:\Users\Admin\AppData\Local\vqauxh.exe
4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:2612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\vqauxh.exe
Filesize
92KB

MD5
09acbc29a773770217696c4ff0e96a45

SHA1
21a967bdcefa1ce3d2df38d7bf426ac2cec452db

SHA256
a13c5b159b96a1a270a260617edce66c7a13cdd85ee3406032c25cdf1b3bf669

SHA512
be2f7b817b13083323d7fbc67a42fe6d65766b64503a2361108a8856396a7aae863445d6e47c624603f9348ca68da3a8c758592bc01b7e22773436d7e23b7d97

Download Submit
memory/2304-58-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-16-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-18-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-24-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-26-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2304-27-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-72-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-76-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-87-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-86-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-85-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-84-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-70-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-83-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-73-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-74-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-82-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-81-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-77-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-78-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-79-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2612-80-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2776-46-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2776-75-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2776-68-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2776-54-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2776-47-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2932-8-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/2932-10-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads