23ff4eb48f2c98a3868ee8abbfcd28427f877864759e0d84c82895b51f78e8d0

General

Target

387e8c87ac61853543b43747feff0897.exe
Size

515KB
MD5

387e8c87ac61853543b43747feff0897
SHA1

6505a260581d6d78b3c8ca0501b56e266ac25d4f
SHA256

23ff4eb48f2c98a3868ee8abbfcd28427f877864759e0d84c82895b51f78e8d0
SHA512

5451d60875562cf41bcdd703edd7a1efde19b1ed86f7a78f69a52e8d05b34b437e9704ed1c576d54e364c55a66274922f09138d220d30d675c17418967a16e29
SSDEEP

12288:wf2QkXEU9Nha3ZqyBPoMrliN/ddRAe8CT:QxeEo+LBPorzRAe7T

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4740	attrib.exe
2920	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
840	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 684 set thread context of 840	684	387e8c87ac61853543b43747feff0897.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	387e8c87ac61853543b43747feff0897.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31
PID 684 wrote to memory of 840	684	387e8c87ac61853543b43747feff0897.exe	31

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4740	attrib.exe
2920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\387e8c87ac61853543b43747feff0897.exe
"C:\Users\Admin\AppData\Local\Temp\387e8c87ac61853543b43747feff0897.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h
    3⤵
    PID:4996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    PID:3824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2920
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    PID:2012
- C:\Users\Admin\AppData\Local\Temp\RSbot.exe
  "C:\Users\Admin\AppData\Local\Temp\RSbot.exe"
  2⤵
  PID:3156
- - C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe"
    3⤵
    PID:4372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\j.vbs"
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-2-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/684-0-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/684-3-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download
memory/684-1-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download
memory/684-108-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/684-100-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/840-18-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/840-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/840-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/840-93-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/840-6-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/840-9-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3156-79-0x000000001C010000-0x000000001C4DE000-memory.dmp

Filesize
4.8MB

Download
memory/3156-80-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/3156-77-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/3156-78-0x0000000001350000-0x0000000001360000-memory.dmp

Filesize
64KB

Download
memory/3156-76-0x000000001BA90000-0x000000001BB36000-memory.dmp

Filesize
664KB

Download
memory/3156-97-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/3156-82-0x000000001C800000-0x000000001C89C000-memory.dmp

Filesize
624KB

Download
memory/4372-98-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/4372-99-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/4372-109-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4372-111-0x0000000001360000-0x0000000001370000-memory.dmp

Filesize
64KB

Download
memory/4372-113-0x0000000001360000-0x0000000001370000-memory.dmp

Filesize
64KB

Download
memory/4372-114-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download
memory/4372-112-0x00007FFEDA4F0000-0x00007FFEDAE91000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads