b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a

General

Target

b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
Size

683KB
MD5

b0e4c2172afcdb89e7cb65ad3dfb7145
SHA1

19580c0f3b97602d93094fd1eb8fd27579e9d17e
SHA256

b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a
SHA512

c4c6e3e3999ec7780696a22066906ac7b672136f480502a64c955098024620d1e694b9018377521780c668cf26c2dc36f4e82fc8ee808f1432c37938c2c7c93a
SSDEEP

12288:PK5yuMYwM2t2t14FNHXsE59stFbfw7V3+HlLwxOiMCyINCK:C5XMYwM2t20p8E5ObSuHlLhlIkK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Semibaldness.exe"	wab.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\devastate.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1044	wab.exe
1044	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
1044	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\duodecimos.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
File opened for modification	C:\Program Files (x86)\hamus.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\folders\Sequenser.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
File opened for modification	C:\Windows\Forglemmes130\coatee.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	wab.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92
PID 4908 wrote to memory of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92
PID 4908 wrote to memory of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92
PID 4908 wrote to memory of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92
PID 4908 wrote to memory of 1044	4908	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	92

C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
"C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\windows mail\wab.exe
  "C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa6CC5.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
C:\Users\Admin\AppData\Roaming\Smklaasens.lnk

Filesize
1KB

MD5
c844c6819dea64155ce5c6c8c67c7848

SHA1
b13df0259ff3319315120778ef723429b802c865

SHA256
8c3b533c29ecf23c517e156a1a26f564dc7e69bc7cdd7e7fcb634db52ae03e84

SHA512
f8b11fc95b9eba25a255fc527c9e4a8a7784e2320aa9bbb2a68f8aa0aa97d0dc08ab51f6b94094b6174ab3283287026cf15201c775779f9aa127a5b68eeb41a5

Download Submit
memory/1044-264-0x0000000002060000-0x00000000079C4000-memory.dmp

Filesize
89.4MB

Download
memory/1044-269-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-261-0x0000000077328000-0x0000000077329000-memory.dmp

Filesize
4KB

Download
memory/1044-262-0x00000000772A1000-0x00000000773C1000-memory.dmp

Filesize
1.1MB

Download
memory/1044-265-0x00000000772A1000-0x00000000773C1000-memory.dmp

Filesize
1.1MB

Download
memory/1044-266-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-267-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-268-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-280-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-279-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-270-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-271-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-272-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-273-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-274-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-276-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-277-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1044-278-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/4908-260-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/4908-259-0x00000000772A1000-0x00000000773C1000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads