29d3c94a7a90b73ae8c3ee5776a176dae164392eb92627383fb177570b2e3498

General

Target

5a43bf16573ed704bae6f47eb5281892.exe
Size

823KB
MD5

5a43bf16573ed704bae6f47eb5281892
SHA1

2590c1e0d94c1b6104473fa8891a59bdc8cdf6fa
SHA256

29d3c94a7a90b73ae8c3ee5776a176dae164392eb92627383fb177570b2e3498
SHA512

0b0f5f42166babc4c3153ececa44b74110f53c558d5b7faa6684876b5dc3e07a04741bd9feaa6e22fabf83c65b870d0f86f83197d0106c79814f49a2f0426e14
SSDEEP

24576:8b80K3OuFD/cGfPy3tZHApPkCVfqqbWnAwT8OXcxb:8h3uhU7XAdk0qqbWAfOU

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
rienafaire99

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.exe	5a43bf16573ed704bae6f47eb5281892.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.exe	5a43bf16573ed704bae6f47eb5281892.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe"	5a43bf16573ed704bae6f47eb5281892.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe"	5a43bf16573ed704bae6f47eb5281892.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2224	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
512	5a43bf16573ed704bae6f47eb5281892.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	5a43bf16573ed704bae6f47eb5281892.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
512	5a43bf16573ed704bae6f47eb5281892.exe
512	5a43bf16573ed704bae6f47eb5281892.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4576	512	5a43bf16573ed704bae6f47eb5281892.exe	93
PID 512 wrote to memory of 4576	512	5a43bf16573ed704bae6f47eb5281892.exe	93
PID 512 wrote to memory of 4576	512	5a43bf16573ed704bae6f47eb5281892.exe	93
PID 4576 wrote to memory of 2224	4576	cmd.exe	95
PID 4576 wrote to memory of 2224	4576	cmd.exe	95
PID 4576 wrote to memory of 2224	4576	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\5a43bf16573ed704bae6f47eb5281892.exe
"C:\Users\Admin\AppData\Local\Temp\5a43bf16573ed704bae6f47eb5281892.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-0-0x0000000000400000-0x0000000000860000-memory.dmp

Filesize
4.4MB

Download
memory/512-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/512-3-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/512-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/512-5-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/512-8-0x0000000000400000-0x0000000000860000-memory.dmp

Filesize
4.4MB

Download
memory/512-10-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/512-11-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/512-12-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/512-14-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/512-16-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads