fa0d4585aac314d370386f8fdf8eb83dbad25cb22b571dd8a8a9abbd9a635905

General

Target

29aae1645f627d9621f8a0cbcc72876e.exe
Size

140KB
MD5

29aae1645f627d9621f8a0cbcc72876e
SHA1

1460b03a748e114f3bfc62eff3290729700901f5
SHA256

fa0d4585aac314d370386f8fdf8eb83dbad25cb22b571dd8a8a9abbd9a635905
SHA512

6b1c785d12b5dad8b01fbb0a4eb1bc5e5c81568a7cb8cdc079192217075be2eeeacb827f9650478370f9b0d706c9fa0b4227d9932d2818ff19403453121434c1
SSDEEP

3072:b1avQJ7ZoKRGXf2N5dqQiY1S7G0xp2coA:b1a4JWpwD1SRxpf

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2728	netsh.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xcjrm.exe	aotaae.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xcjrm.exe	29aae1645f627d9621f8a0cbcc72876e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xcjrm.exe	29aae1645f627d9621f8a0cbcc72876e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xcjrm.exe	aotaae.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	aotaae.exe
2936	aotaae.exe

Loads dropped DLL 1 IoCs

pid	Process
2684	29aae1645f627d9621f8a0cbcc72876e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\baijrubg = "C:\\Users\\Admin\\AppData\\Local\\aotaae.exe"	29aae1645f627d9621f8a0cbcc72876e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\baijrubg = "C:\\Users\\Admin\\AppData\\Local\\aotaae.exe"	29aae1645f627d9621f8a0cbcc72876e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\baijrubg = "C:\\Users\\Admin\\AppData\\Local\\aotaae.exe"	aotaae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\baijrubg = "C:\\Users\\Admin\\AppData\\Local\\aotaae.exe"	aotaae.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2784 set thread context of 2936	2784	aotaae.exe	33

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2224 wrote to memory of 2684	2224	29aae1645f627d9621f8a0cbcc72876e.exe	30
PID 2684 wrote to memory of 2728	2684	29aae1645f627d9621f8a0cbcc72876e.exe	31
PID 2684 wrote to memory of 2728	2684	29aae1645f627d9621f8a0cbcc72876e.exe	31
PID 2684 wrote to memory of 2728	2684	29aae1645f627d9621f8a0cbcc72876e.exe	31
PID 2684 wrote to memory of 2728	2684	29aae1645f627d9621f8a0cbcc72876e.exe	31
PID 2684 wrote to memory of 2784	2684	29aae1645f627d9621f8a0cbcc72876e.exe	32
PID 2684 wrote to memory of 2784	2684	29aae1645f627d9621f8a0cbcc72876e.exe	32
PID 2684 wrote to memory of 2784	2684	29aae1645f627d9621f8a0cbcc72876e.exe	32
PID 2684 wrote to memory of 2784	2684	29aae1645f627d9621f8a0cbcc72876e.exe	32
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33
PID 2784 wrote to memory of 2936	2784	aotaae.exe	33

C:\Users\Admin\AppData\Local\Temp\29aae1645f627d9621f8a0cbcc72876e.exe
"C:\Users\Admin\AppData\Local\Temp\29aae1645f627d9621f8a0cbcc72876e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\29aae1645f627d9621f8a0cbcc72876e.exe
  C:\Users\Admin\AppData\Local\Temp\29aae1645f627d9621f8a0cbcc72876e.exe
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram 1.exe 1 ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2728
- - C:\Users\Admin\AppData\Local\aotaae.exe
    "C:\Users\Admin\AppData\Local\aotaae.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\aotaae.exe
      C:\Users\Admin\AppData\Local\aotaae.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\aotaae.exe

Filesize
140KB

MD5
29aae1645f627d9621f8a0cbcc72876e

SHA1
1460b03a748e114f3bfc62eff3290729700901f5

SHA256
fa0d4585aac314d370386f8fdf8eb83dbad25cb22b571dd8a8a9abbd9a635905

SHA512
6b1c785d12b5dad8b01fbb0a4eb1bc5e5c81568a7cb8cdc079192217075be2eeeacb827f9650478370f9b0d706c9fa0b4227d9932d2818ff19403453121434c1

Download Submit
memory/2224-8-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2224-9-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2224-12-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2224-15-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2684-19-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-17-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-21-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-26-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-28-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-29-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2684-38-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2784-48-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-77-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-53-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-55-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-57-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-71-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2784-50-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2936-75-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-76-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-73-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-78-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-79-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-80-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-81-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-82-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-83-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-84-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2936-85-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads