965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade

General

Target

a1b59d03f0a157cfef36e4c35d29e081.exe
Size

59KB
MD5

a1b59d03f0a157cfef36e4c35d29e081
SHA1

d283877365574dffe682bbe213451acbb57e4b93
SHA256

965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade
SHA512

42086c2239e3b518b9b19c4b1379ffd9121bbbeabc342710b47e8e3a6656960b468bf72a57d2498c141295efdc83edb200e9de074297340fa1cb8a2d8ecd78f5
SSDEEP

1536:MvU70UUfsjwIXu3/4ZmkBps+LXP6B+Jnouy83O:1zUEjwb3AZ++LXSB+Zout3O

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2968	netprotocol.exe
2476	netprotocol.exe

Loads dropped DLL 2 IoCs

pid	Process
2936	a1b59d03f0a157cfef36e4c35d29e081.exe
2936	a1b59d03f0a157cfef36e4c35d29e081.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2936-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2936-6-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2936-10-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2936-31-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2476-32-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2936-33-0x0000000000220000-0x0000000000265000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	a1b59d03f0a157cfef36e4c35d29e081.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2968 set thread context of 2476	2968	netprotocol.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	a1b59d03f0a157cfef36e4c35d29e081.exe
2968	netprotocol.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2868 wrote to memory of 2936	2868	a1b59d03f0a157cfef36e4c35d29e081.exe	28
PID 2936 wrote to memory of 2968	2936	a1b59d03f0a157cfef36e4c35d29e081.exe	29
PID 2936 wrote to memory of 2968	2936	a1b59d03f0a157cfef36e4c35d29e081.exe	29
PID 2936 wrote to memory of 2968	2936	a1b59d03f0a157cfef36e4c35d29e081.exe	29
PID 2936 wrote to memory of 2968	2936	a1b59d03f0a157cfef36e4c35d29e081.exe	29
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30
PID 2968 wrote to memory of 2476	2968	netprotocol.exe	30

C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe
"C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe
  "C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      "C:\Users\Admin\AppData\Roaming\netprotocol.exe"
      4⤵
      Executes dropped EXE
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
59KB

MD5
9a6fe98528ea9a5cc6ee452823c8e44d

SHA1
cc2a5fecbb313bf6e38fa4878834de1124f7dfc0

SHA256
4872c00d72c2785cedbf170172a489ab6aadf6e78bac985fdfba259ed6ce20f6

SHA512
39cc495fed54d8bd2130c6071adb4f3b81a199699dd6d0b5c755f1042049b90e29f6d006bfab99b53bc33afd852c94477a3e27300e2fdddd37cd539da7ec89fd

Download Submit
memory/2476-32-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2868-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2868-4-0x0000000000280000-0x00000000002C5000-memory.dmp

Filesize
276KB

Download
memory/2868-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2936-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-19-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/2936-22-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/2936-31-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-33-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/2968-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2968-28-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads