f81ab3359080addc2a6f5e891b276af6c703b223d57f5a111bc46702a0955952

General

Target

75142584cb192706ad5d3b11b9eaf91d.exe
Size

96KB
MD5

75142584cb192706ad5d3b11b9eaf91d
SHA1

a169e096d9b857e83cedb1cfd44f62851902be6f
SHA256

f81ab3359080addc2a6f5e891b276af6c703b223d57f5a111bc46702a0955952
SHA512

923e894d0873c5796cf79b66144e781a4800aa3ae7029f8f20e0edf0a17652473bc25c173b21211c158913ae51c167b805f5529765c7b9f6057fb0abcf5e78c3
SSDEEP

1536:Gtn6qM+9ETOMMjwRTfh+VkMnTvXb8VHhAuQWJyieWo4DDAibGvzNK8Y2eWF:A6qnEFBf4kMT/eBUE7eWo4DkJzDY2eWF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

34C30.exe34C30.exe1CC02.exe

pid process

2356 34C30.exe
2864 34C30.exe
1536 1CC02.exe

pid	process
2356	34C30.exe
2864	34C30.exe
1536	1CC02.exe

Loads dropped DLL 8 IoCs

Processes:

75142584cb192706ad5d3b11b9eaf91d.exe34C30.exe1CC02.exe

pid	process
2208	75142584cb192706ad5d3b11b9eaf91d.exe
2208	75142584cb192706ad5d3b11b9eaf91d.exe
2864	34C30.exe
2864	34C30.exe
1536	1CC02.exe
1536	1CC02.exe
1536	1CC02.exe
1536	1CC02.exe

Drops file in System32 directory 13 IoCs

Processes:

75142584cb192706ad5d3b11b9eaf91d.exe1CC02.exe34C30.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\34C30.exe	75142584cb192706ad5d3b11b9eaf91d.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	1CC02.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KZPY980W.txt	1CC02.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\7M741Q5L.txt	1CC02.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XQRK0H4B.htm	1CC02.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	34C30.exe
File opened for modification	C:\Windows\SysWOW64\1CC02.exe	34C30.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Q24D3T7Z.txt	1CC02.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\MCZ8J94X.txt	1CC02.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\7M741Q5L.txt	1CC02.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Q24D3T7Z.txt	1CC02.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KZPY980W.txt	1CC02.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\MCZ8J94X.txt	1CC02.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

1CC02.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	1CC02.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}\WpadDecisionTime = 1074a1f1b24fda01	1CC02.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}\WpadNetworkName = "Network 3"	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}\f2-1b-74-16-08-d7	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1b-74-16-08-d7\WpadDecisionReason = "1"	1CC02.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}\WpadDecision = "0"	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	1CC02.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{015653D1-EF28-481E-A84B-9FD7EAD49A42}\WpadDecisionReason = "1"	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1b-74-16-08-d7\WpadDecision = "0"	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	1CC02.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	1CC02.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	1CC02.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1b-74-16-08-d7\WpadDecisionTime = 1074a1f1b24fda01	1CC02.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	1CC02.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	1CC02.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	1CC02.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1b-74-16-08-d7	1CC02.exe

Modifies registry class 64 IoCs

Processes:

1CC02.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	1CC02.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX, 1"	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	1CC02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	1CC02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	1CC02.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	1CC02.exe

Runs net.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

75142584cb192706ad5d3b11b9eaf91d.exe34C30.exe34C30.exe1CC02.exe

pid process

2208 75142584cb192706ad5d3b11b9eaf91d.exe
2356 34C30.exe
2864 34C30.exe
1536 1CC02.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

75142584cb192706ad5d3b11b9eaf91d.exe34C30.execmd.execmd.execmd.exenet.exenet.exenet.exe34C30.execmd.exenet.exe

description	pid	process	target process
PID 2208 wrote to memory of 2356	2208	75142584cb192706ad5d3b11b9eaf91d.exe	34C30.exe
PID 2208 wrote to memory of 2356	2208	75142584cb192706ad5d3b11b9eaf91d.exe	34C30.exe
PID 2208 wrote to memory of 2356	2208	75142584cb192706ad5d3b11b9eaf91d.exe	34C30.exe
PID 2208 wrote to memory of 2356	2208	75142584cb192706ad5d3b11b9eaf91d.exe	34C30.exe
PID 2356 wrote to memory of 2348	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2348	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2348	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2348	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	34C30.exe	cmd.exe
PID 2356 wrote to memory of 2788	2356	34C30.exe	cmd.exe
PID 2348 wrote to memory of 2852	2348	cmd.exe	net.exe
PID 2348 wrote to memory of 2852	2348	cmd.exe	net.exe
PID 2348 wrote to memory of 2852	2348	cmd.exe	net.exe
PID 2348 wrote to memory of 2852	2348	cmd.exe	net.exe
PID 2208 wrote to memory of 2792	2208	75142584cb192706ad5d3b11b9eaf91d.exe	cmd.exe
PID 2208 wrote to memory of 2792	2208	75142584cb192706ad5d3b11b9eaf91d.exe	cmd.exe
PID 2208 wrote to memory of 2792	2208	75142584cb192706ad5d3b11b9eaf91d.exe	cmd.exe
PID 2208 wrote to memory of 2792	2208	75142584cb192706ad5d3b11b9eaf91d.exe	cmd.exe
PID 2792 wrote to memory of 2024	2792	cmd.exe	net.exe
PID 2792 wrote to memory of 2024	2792	cmd.exe	net.exe
PID 2792 wrote to memory of 2024	2792	cmd.exe	net.exe
PID 2792 wrote to memory of 2024	2792	cmd.exe	net.exe
PID 2788 wrote to memory of 2876	2788	cmd.exe	net.exe
PID 2788 wrote to memory of 2876	2788	cmd.exe	net.exe
PID 2788 wrote to memory of 2876	2788	cmd.exe	net.exe
PID 2788 wrote to memory of 2876	2788	cmd.exe	net.exe
PID 2852 wrote to memory of 2860	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2860	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2860	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2860	2852	net.exe	net1.exe
PID 2024 wrote to memory of 2732	2024	net.exe	net1.exe
PID 2024 wrote to memory of 2732	2024	net.exe	net1.exe
PID 2024 wrote to memory of 2732	2024	net.exe	net1.exe
PID 2024 wrote to memory of 2732	2024	net.exe	net1.exe
PID 2876 wrote to memory of 2900	2876	net.exe	net1.exe
PID 2876 wrote to memory of 2900	2876	net.exe	net1.exe
PID 2876 wrote to memory of 2900	2876	net.exe	net1.exe
PID 2876 wrote to memory of 2900	2876	net.exe	net1.exe
PID 2864 wrote to memory of 2756	2864	34C30.exe	cmd.exe
PID 2864 wrote to memory of 2756	2864	34C30.exe	cmd.exe
PID 2864 wrote to memory of 2756	2864	34C30.exe	cmd.exe
PID 2864 wrote to memory of 2756	2864	34C30.exe	cmd.exe
PID 2756 wrote to memory of 2744	2756	cmd.exe	net.exe
PID 2756 wrote to memory of 2744	2756	cmd.exe	net.exe
PID 2756 wrote to memory of 2744	2756	cmd.exe	net.exe
PID 2756 wrote to memory of 2744	2756	cmd.exe	net.exe
PID 2744 wrote to memory of 1624	2744	net.exe	net1.exe
PID 2744 wrote to memory of 1624	2744	net.exe	net1.exe
PID 2744 wrote to memory of 1624	2744	net.exe	net1.exe
PID 2744 wrote to memory of 1624	2744	net.exe	net1.exe
PID 2864 wrote to memory of 1536	2864	34C30.exe	1CC02.exe
PID 2864 wrote to memory of 1536	2864	34C30.exe	1CC02.exe
PID 2864 wrote to memory of 1536	2864	34C30.exe	1CC02.exe
PID 2864 wrote to memory of 1536	2864	34C30.exe	1CC02.exe

C:\Users\Admin\AppData\Local\Temp\75142584cb192706ad5d3b11b9eaf91d.exe
"C:\Users\Admin\AppData\Local\Temp\75142584cb192706ad5d3b11b9eaf91d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\34C30.exe
C:\Windows\system32\34C30.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c "net start 34C30"
3⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\net.exe
net start 34C30
4⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start 34C30
5⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd /c "net start 34C30"
3⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\net.exe
net start 34C30
4⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start 34C30
5⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd /c "net start 34C30"
2⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\net.exe
net start 34C30
3⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start 34C30
4⤵
PID:2732

C:\Windows\SysWOW64\34C30.exe
C:\Windows\SysWOW64\34C30.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd /c "net start 34C30"
2⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\net.exe
net start 34C30
3⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start 34C30
4⤵
PID:1624

C:\Windows\SysWOW64\1CC02.exe
C:\Windows\system32\1CC02.exe eee
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSWINSCK.OCX
Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\SysWOW64\1CC02.exe
Filesize
104KB

MD5
840b1eb2c3e003f542d8f0b5a0a09f5c

SHA1
c3d3b721d5a941c16307265e6ef1b339474ef201

SHA256
7910ee7760acc55a9a440e819f5d72153169e8b84dfdb508575feaea4e1ad18c

SHA512
4d26490d9b48a179828001e749d932c82c4cc4941b1f5c5bd864a5427d802dbc799652f65117235f9346bee233c1db3718a0ad10c5614c88613b88a878291509

Download Submit
\Windows\SysWOW64\34C30.exe
Filesize
96KB

MD5
75142584cb192706ad5d3b11b9eaf91d

SHA1
a169e096d9b857e83cedb1cfd44f62851902be6f

SHA256
f81ab3359080addc2a6f5e891b276af6c703b223d57f5a111bc46702a0955952

SHA512
923e894d0873c5796cf79b66144e781a4800aa3ae7029f8f20e0edf0a17652473bc25c173b21211c158913ae51c167b805f5529765c7b9f6057fb0abcf5e78c3

Download Submit
memory/2208-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2208-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2208-6-0x0000000000450000-0x0000000000498000-memory.dmp

Filesize
288KB

Download
memory/2208-13-0x0000000000450000-0x0000000000498000-memory.dmp

Filesize
288KB

Download
memory/2208-18-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2356-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2356-17-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2864-20-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2864-40-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads