24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043

General

Target

429ac1a806b4fcdc9bf44ea6987f94f6.exe
Size

123KB
MD5

429ac1a806b4fcdc9bf44ea6987f94f6
SHA1

8e4bb6295d40c6f19aab7c47cca3d945747d41e4
SHA256

24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043
SHA512

50dbab8769fc80ec291d338390dc3d6ea080ebd969a7cac47d23afcce4f9183b6ffbc0d5ad4a35191ea6300c60d501515f574feee47741c70bd09acce72685b4
SSDEEP

3072:Lf3nTY/Afey9FpatoPnprvFFE3sHX2qawogX48:rT68ey9utonprOe2q

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Wow6432Node = "C:\\Users\\Admin\\AppData\\Roaming\\0D1506.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

Executes dropped EXE 2 IoCs

Processes:

NOygl.execvtres.exe

pid process

2104 NOygl.exe
2808 cvtres.exe
Loads dropped DLL 3 IoCs

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exeNOygl.exe

pid process

1700 429ac1a806b4fcdc9bf44ea6987f94f6.exe
1700 429ac1a806b4fcdc9bf44ea6987f94f6.exe
2104 NOygl.exe

pid	process
2104	NOygl.exe
2808	cvtres.exe

pid	process
1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe
1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe
2104	NOygl.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cvtres.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

NOygl.exe

description pid process target process

PID 2104 set thread context of 2808 2104 NOygl.exe cvtres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

NOygl.exe

pid process

2104 NOygl.exe
2104 NOygl.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

cvtres.exe

pid process

2808 cvtres.exe
2808 cvtres.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NOygl.exe

description pid process

Token: SeDebugPrivilege 2104 NOygl.exe

description	pid	process	target process
PID 2104 set thread context of 2808	2104	NOygl.exe	cvtres.exe

pid	process
2104	NOygl.exe
2104	NOygl.exe

pid	process
2808	cvtres.exe
2808	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	2104	NOygl.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

429ac1a806b4fcdc9bf44ea6987f94f6.exeNOygl.execvtres.exe

description	pid	process	target process
PID 1700 wrote to memory of 2104	1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe	NOygl.exe
PID 1700 wrote to memory of 2104	1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe	NOygl.exe
PID 1700 wrote to memory of 2104	1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe	NOygl.exe
PID 1700 wrote to memory of 2104	1700	429ac1a806b4fcdc9bf44ea6987f94f6.exe	NOygl.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2104 wrote to memory of 2808	2104	NOygl.exe	cvtres.exe
PID 2808 wrote to memory of 2728	2808	cvtres.exe	svchost.exe
PID 2808 wrote to memory of 2728	2808	cvtres.exe	svchost.exe
PID 2808 wrote to memory of 2728	2808	cvtres.exe	svchost.exe
PID 2808 wrote to memory of 2728	2808	cvtres.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe
"C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\NOygl.exe
"C:\Users\Admin\AppData\Local\Temp\NOygl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\cvtres.exe
C:\Users\Admin\AppData\Local\Temp\\cvtres.exe
1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds policy Run key to start application
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\NOygl.exe
Filesize
77KB

MD5
2b0653fd5eca2b3b2c62a11beb3529f1

SHA1
97ded9593b80038976ef9f4f5360ec173476508d

SHA256
35b8cea3645e9478855787160752e5feb62156d5780213db82fe96a17a7534e5

SHA512
cdba35b21c95eaacefe770ee7537a07d4893e39a34ee594f367363d774eed1c9b2ddd834459934d81f93c763eea57ec9df084ea2bfa978c17c5b5e2ab42bb5e2

Download Submit
memory/1700-1-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/1700-2-0x0000000002290000-0x00000000022D0000-memory.dmp

Filesize
256KB

Download
memory/1700-13-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/1700-0-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-14-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-28-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-15-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download
memory/2104-30-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-37-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2728-46-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2728-42-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2728-43-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2728-35-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/2728-36-0x0000000000100000-0x0000000000104000-memory.dmp

Filesize
16KB

Download
memory/2728-33-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/2808-20-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2808-32-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2808-31-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2808-29-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2808-22-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2808-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-26-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads