ed668ff7ee404b9760e202418bae61d92a08a7f23c7af1f9b1aa101c7afe36b9

General

Target

98d6e408564d13dad455d10833b2913e.exe
Size

69KB
MD5

98d6e408564d13dad455d10833b2913e
SHA1

d27f6c00813168fd4bfa9d252699e9ee77e6ce3e
SHA256

ed668ff7ee404b9760e202418bae61d92a08a7f23c7af1f9b1aa101c7afe36b9
SHA512

abc305fc3c49691cebdbd6a3fca9daa6e3d5768ccd55bc9c214bf51c30cfbef0539c4aa2290df7981e9ae062e649d4f1f13eb8bdf895ecdfea4f5d2a56828c2c
SSDEEP

1536:/ao/Bt2a9v0gxiiURAcftQSiX8Bhav0B75Tjcjmn4CUye:/7JIcjiEciF70BKjm4CDe

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4796	netprotocol.exe
4448	netprotocol.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-0-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4056-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4228-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4056-6-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4056-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4056-9-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/files/0x00070000000231fd-11.dat	upx
behavioral2/memory/4796-12-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4796-20-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4056-22-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4448-23-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	98d6e408564d13dad455d10833b2913e.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4796 set thread context of 4448	4796	netprotocol.exe	84

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4228	98d6e408564d13dad455d10833b2913e.exe
4796	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4228 wrote to memory of 4056	4228	98d6e408564d13dad455d10833b2913e.exe	82
PID 4056 wrote to memory of 4796	4056	98d6e408564d13dad455d10833b2913e.exe	83
PID 4056 wrote to memory of 4796	4056	98d6e408564d13dad455d10833b2913e.exe	83
PID 4056 wrote to memory of 4796	4056	98d6e408564d13dad455d10833b2913e.exe	83
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84
PID 4796 wrote to memory of 4448	4796	netprotocol.exe	84

C:\Users\Admin\AppData\Local\Temp\98d6e408564d13dad455d10833b2913e.exe
"C:\Users\Admin\AppData\Local\Temp\98d6e408564d13dad455d10833b2913e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\98d6e408564d13dad455d10833b2913e.exe
  C:\Users\Admin\AppData\Local\Temp\98d6e408564d13dad455d10833b2913e.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
69KB

MD5
e91951f55b6829d9d8ebdcf3db0ae5a3

SHA1
946720419cf8f5a94914dfd51e11549b69690ba4

SHA256
3f1a95e856b44fecf53eb172e26296a7e69de5319f25fbd398ce4583252aee1f

SHA512
b3e110f9b02ff0970a404481362fee6e8ff7b495b7ae3da42b768f282f9b85df4f935dfec1cf44ab3cc3c9b03c639ca3dfc06364d45aaf4259d375a0bbfac7a6

Download Submit
memory/4056-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4056-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4056-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4056-9-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4056-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4056-28-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/4228-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4228-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4448-23-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4796-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4796-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads