31ca86832e3083bfa7215d45446478c8b22d0a2f3144b35e594f90d197957ab7

General

Target

0e8169bd0199567b1b87b319fedd0731.exe
Size

173KB
MD5

0e8169bd0199567b1b87b319fedd0731
SHA1

b6ae50be966bf428198123894c45b6bc8b2e06e5
SHA256

31ca86832e3083bfa7215d45446478c8b22d0a2f3144b35e594f90d197957ab7
SHA512

f2cac81147e8a0ed8de30e09659fda99abb4c944bc730ccc9b59ed63330860d9245cc9be838203850fa906e0777be0a6d741601f908d1886c1ce9de8ca8a4ecd
SSDEEP

3072:KikdYkPuXhgXpjaubweQb5u4dL5Lp2OG75engtD4GzXxNarGZmjMR0fGHXjBz:noYkPu8xaNNdZIOGFl4gMVfG3jB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2936	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1380	Explorer.EXE
480	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3627615824-4061627003-3019543961-1000\\$dd77332d3cac1fe86ec72350d0346c53\\n."	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$dd77332d3cac1fe86ec72350d0346c53\\n."	0e8169bd0199567b1b87b319fedd0731.exe

Unexpected DNS network traffic destination 18 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 780 set thread context of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\clsid	0e8169bd0199567b1b87b319fedd0731.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	0e8169bd0199567b1b87b319fedd0731.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3627615824-4061627003-3019543961-1000\\$dd77332d3cac1fe86ec72350d0346c53\\n."	0e8169bd0199567b1b87b319fedd0731.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$dd77332d3cac1fe86ec72350d0346c53\\n."	0e8169bd0199567b1b87b319fedd0731.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
780	0e8169bd0199567b1b87b319fedd0731.exe
780	0e8169bd0199567b1b87b319fedd0731.exe
780	0e8169bd0199567b1b87b319fedd0731.exe
780	0e8169bd0199567b1b87b319fedd0731.exe
780	0e8169bd0199567b1b87b319fedd0731.exe
780	0e8169bd0199567b1b87b319fedd0731.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	0e8169bd0199567b1b87b319fedd0731.exe
Token: SeDebugPrivilege	780	0e8169bd0199567b1b87b319fedd0731.exe
Token: SeDebugPrivilege	780	0e8169bd0199567b1b87b319fedd0731.exe
Token: SeBackupPrivilege	480	services.exe
Token: SeRestorePrivilege	480	services.exe
Token: SeSecurityPrivilege	480	services.exe
Token: SeTakeOwnershipPrivilege	480	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1380	780	0e8169bd0199567b1b87b319fedd0731.exe	7
PID 780 wrote to memory of 1380	780	0e8169bd0199567b1b87b319fedd0731.exe	7
PID 780 wrote to memory of 480	780	0e8169bd0199567b1b87b319fedd0731.exe	22
PID 780 wrote to memory of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29
PID 780 wrote to memory of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29
PID 780 wrote to memory of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29
PID 780 wrote to memory of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29
PID 780 wrote to memory of 2936	780	0e8169bd0199567b1b87b319fedd0731.exe	29

C:\Users\Admin\AppData\Local\Temp\0e8169bd0199567b1b87b319fedd0731.exe
"C:\Users\Admin\AppData\Local\Temp\0e8169bd0199567b1b87b319fedd0731.exe"
1⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:2936

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-14-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/780-2-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/780-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/780-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1380-3-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1380-8-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1380-16-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads