c6eed847f0d3522fbcdfbbc4a7806e6943d9a3fbb3e1cfeb95bd0d87eb776145

General

Target

3fb01b99289afbb69f94fb5d7895cd44.exe
Size

48KB
MD5

3fb01b99289afbb69f94fb5d7895cd44
SHA1

d43882830dc42599c284ffb24d10a88419b793a9
SHA256

c6eed847f0d3522fbcdfbbc4a7806e6943d9a3fbb3e1cfeb95bd0d87eb776145
SHA512

133b1eddf081d66894c4a4a1603a80e8808ecbe31e8953a1208d5c03309ebaa979b11a06874d8dd06f18f2deb26dfd66a6d5eadc7680a7128bbdd8b1015c6e61
SSDEEP

768:to4IuGXkKB/eln6kH2rZc+Ed8k/UM8LWIUFuITZe7E9QFpoINPz87:XGXkKFekLZk/UzLWIUt8I9YSINPK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2840	live.messenger.com
2680	live.messenger.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSN Messenger = "live.messenger.com"	3fb01b99289afbb69f94fb5d7895cd44.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 2840 set thread context of 2680	2840	live.messenger.com	19

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\live.messenger.com	3fb01b99289afbb69f94fb5d7895cd44.exe
File opened for modification	C:\Windows\live.messenger.com	3fb01b99289afbb69f94fb5d7895cd44.exe
File opened for modification	C:\Windows\live.messenger.com	live.messenger.com
File created	C:\Windows\admintxt.txt	live.messenger.com

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1992	3fb01b99289afbb69f94fb5d7895cd44.exe
2840	live.messenger.com

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 1992 wrote to memory of 2948	1992	3fb01b99289afbb69f94fb5d7895cd44.exe	21
PID 2948 wrote to memory of 2840	2948	3fb01b99289afbb69f94fb5d7895cd44.exe	20
PID 2948 wrote to memory of 2840	2948	3fb01b99289afbb69f94fb5d7895cd44.exe	20
PID 2948 wrote to memory of 2840	2948	3fb01b99289afbb69f94fb5d7895cd44.exe	20
PID 2948 wrote to memory of 2840	2948	3fb01b99289afbb69f94fb5d7895cd44.exe	20
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19
PID 2840 wrote to memory of 2680	2840	live.messenger.com	19

C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe
"C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe
  C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2948

C:\Windows\live.messenger.com
C:\Windows\live.messenger.com
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2680

C:\Windows\live.messenger.com
"C:\Windows\live.messenger.com"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-42-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-49-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-56-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-55-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-43-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-39-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2680-38-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2680-53-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-52-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-51-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-50-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-44-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2680-48-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-54-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-47-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-45-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2680-46-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2948-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-14-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2948-11-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-40-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-41-0x0000000000400000-0x000000000044AE6C-memory.dmp

Filesize
299KB

Download
memory/2948-13-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads