965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade

General

Target

a1b59d03f0a157cfef36e4c35d29e081.exe
Size

59KB
MD5

a1b59d03f0a157cfef36e4c35d29e081
SHA1

d283877365574dffe682bbe213451acbb57e4b93
SHA256

965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade
SHA512

42086c2239e3b518b9b19c4b1379ffd9121bbbeabc342710b47e8e3a6656960b468bf72a57d2498c141295efdc83edb200e9de074297340fa1cb8a2d8ecd78f5
SSDEEP

1536:MvU70UUfsjwIXu3/4ZmkBps+LXP6B+Jnouy83O:1zUEjwb3AZ++LXSB+Zout3O

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1944	netprotocol.exe
404	netprotocol.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3088-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3088-6-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3088-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3088-21-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/404-22-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	a1b59d03f0a157cfef36e4c35d29e081.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1944 set thread context of 404	1944	netprotocol.exe	90

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	a1b59d03f0a157cfef36e4c35d29e081.exe
1944	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 1816 wrote to memory of 3088	1816	a1b59d03f0a157cfef36e4c35d29e081.exe	88
PID 3088 wrote to memory of 1944	3088	a1b59d03f0a157cfef36e4c35d29e081.exe	89
PID 3088 wrote to memory of 1944	3088	a1b59d03f0a157cfef36e4c35d29e081.exe	89
PID 3088 wrote to memory of 1944	3088	a1b59d03f0a157cfef36e4c35d29e081.exe	89
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90
PID 1944 wrote to memory of 404	1944	netprotocol.exe	90

C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe
"C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe
  "C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      "C:\Users\Admin\AppData\Roaming\netprotocol.exe"
      4⤵
      Executes dropped EXE
      PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
59KB

MD5
9a6fe98528ea9a5cc6ee452823c8e44d

SHA1
cc2a5fecbb313bf6e38fa4878834de1124f7dfc0

SHA256
4872c00d72c2785cedbf170172a489ab6aadf6e78bac985fdfba259ed6ce20f6

SHA512
39cc495fed54d8bd2130c6071adb4f3b81a199699dd6d0b5c755f1042049b90e29f6d006bfab99b53bc33afd852c94477a3e27300e2fdddd37cd539da7ec89fd

Download Submit
memory/404-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1816-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1816-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-19-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3088-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3088-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3088-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3088-21-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3088-29-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads