559bb78bade60153f0b66f39c46774dcca72b00cf95d9ee5ba551f657aff0259

General

Target

0f81d1ffb6286e8762489c5b8cd17655.exe
Size

356KB
MD5

0f81d1ffb6286e8762489c5b8cd17655
SHA1

5d558b4687c8365adaea0da111d69dab27b3cefe
SHA256

559bb78bade60153f0b66f39c46774dcca72b00cf95d9ee5ba551f657aff0259
SHA512

c28570df2283b9e4f2b7d44c919dc0e60fd60df00f4106c5964961b7bb9aaa164fc7af07c72fde856e561ff5ad9662bcc2ea1df754c636d4cd468c1c631de559
SSDEEP

6144:7vbx8GXBQSInhPUfpJtdi8ZD+clIBOMba2EtKOLOO/J:7TqVUvy8ZDnlIBhah5LOO/J

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	n3vkpXrLoQbx6upf.exe

Executes dropped EXE 2 IoCs

pid	Process
2796	n3vkpXrLoQbx6upf.exe
2760	n3vkpXrLoQbx6upf.exe

Loads dropped DLL 4 IoCs

pid	Process
2896	0f81d1ffb6286e8762489c5b8cd17655.exe
2896	0f81d1ffb6286e8762489c5b8cd17655.exe
2896	0f81d1ffb6286e8762489c5b8cd17655.exe
2760	n3vkpXrLoQbx6upf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\y5d7AwGprUW = "C:\\ProgramData\\337yzzRfJ5R2q\\n3vkpXrLoQbx6upf.exe"	0f81d1ffb6286e8762489c5b8cd17655.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 2796 set thread context of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2760 set thread context of 3028	2760	n3vkpXrLoQbx6upf.exe	31

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 1080 wrote to memory of 2896	1080	0f81d1ffb6286e8762489c5b8cd17655.exe	28
PID 2896 wrote to memory of 2796	2896	0f81d1ffb6286e8762489c5b8cd17655.exe	29
PID 2896 wrote to memory of 2796	2896	0f81d1ffb6286e8762489c5b8cd17655.exe	29
PID 2896 wrote to memory of 2796	2896	0f81d1ffb6286e8762489c5b8cd17655.exe	29
PID 2896 wrote to memory of 2796	2896	0f81d1ffb6286e8762489c5b8cd17655.exe	29
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2796 wrote to memory of 2760	2796	n3vkpXrLoQbx6upf.exe	30
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31
PID 2760 wrote to memory of 3028	2760	n3vkpXrLoQbx6upf.exe	31

C:\Users\Admin\AppData\Local\Temp\0f81d1ffb6286e8762489c5b8cd17655.exe
"C:\Users\Admin\AppData\Local\Temp\0f81d1ffb6286e8762489c5b8cd17655.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\0f81d1ffb6286e8762489c5b8cd17655.exe
  "C:\Users\Admin\AppData\Local\Temp\0f81d1ffb6286e8762489c5b8cd17655.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe
    "C:\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe
      "C:\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
        
        "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /i:2760
        5⤵
        
        PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe

Filesize
356KB

MD5
0f81d1ffb6286e8762489c5b8cd17655

SHA1
5d558b4687c8365adaea0da111d69dab27b3cefe

SHA256
559bb78bade60153f0b66f39c46774dcca72b00cf95d9ee5ba551f657aff0259

SHA512
c28570df2283b9e4f2b7d44c919dc0e60fd60df00f4106c5964961b7bb9aaa164fc7af07c72fde856e561ff5ad9662bcc2ea1df754c636d4cd468c1c631de559

Download Submit
\ProgramData\337yzzRfJ5R2q\n3vkpXrLoQbx6upf.exe

Filesize
309KB

MD5
5e5a900272aa00dd66760d44a4b53041

SHA1
53202280cfcaf1afe1a0713633b89ca0befcc27e

SHA256
7f2577a04b5fd89901cda20cda97cd4ae02203167aa99ffe276b237560df143f

SHA512
42b942f580a77f5c24231263bdbe6f47e90208190b34d589a32a24ecdf8577b36df58e29b401336894183d229e4136cd1df0b326196fd9f8661992aad52116d0

Download Submit
memory/1080-9-0x00000000761A0000-0x00000000762B0000-memory.dmp

Filesize
1.1MB

Download
memory/1080-1-0x00000000761A0000-0x00000000762B0000-memory.dmp

Filesize
1.1MB

Download
memory/1080-6-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2760-40-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2760-51-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2796-31-0x00000000761A0000-0x00000000762B0000-memory.dmp

Filesize
1.1MB

Download
memory/2796-36-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2796-39-0x00000000761A0000-0x00000000762B0000-memory.dmp

Filesize
1.1MB

Download
memory/2896-5-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2896-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-25-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2896-7-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2896-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2896-10-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2896-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3028-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3028-53-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3028-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads