d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

General

Target

b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Size

1011KB
MD5

b9ec5d1263ce730e0be1e8cf64c58cf4
SHA1

d30aab11a419fc105a15b9505dbeaa931d19c735
SHA256

d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046
SHA512

60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0
SSDEEP

24576:d3BPQLBt4p3UAh2vFjr0AFnOC6R/TJiUr2Fu+8Q:kQktvFjrX+Ldk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2268	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	01476826.exe

Loads dropped DLL 4 IoCs

pid	Process
2612	cmd.exe
2612	cmd.exe
2660	01476826.exe
2660	01476826.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\01476826 = "C:\\ProgramData\\01476826\\01476826.exe"	b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\01476826 = "C:\\PROGRA~3\\01476826\\01476826.exe"	01476826.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	01476826.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe
2660	01476826.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2268	2104	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	28
PID 2104 wrote to memory of 2268	2104	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	28
PID 2104 wrote to memory of 2268	2104	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	28
PID 2104 wrote to memory of 2268	2104	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	28
PID 2268 wrote to memory of 2612	2268	cmd.exe	30
PID 2268 wrote to memory of 2612	2268	cmd.exe	30
PID 2268 wrote to memory of 2612	2268	cmd.exe	30
PID 2268 wrote to memory of 2612	2268	cmd.exe	30
PID 2612 wrote to memory of 2660	2612	cmd.exe	31
PID 2612 wrote to memory of 2660	2612	cmd.exe	31
PID 2612 wrote to memory of 2660	2612	cmd.exe	31
PID 2612 wrote to memory of 2660	2612	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe
"C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\01476826\01476826.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\01476826\01476826.exe /inst
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\PROGRA~3\01476826\01476826.exe
      C:\PROGRA~3\01476826\01476826.exe /inst
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\01476826\01476826.bat

Filesize
233B

MD5
a9d9eacf45e31eab152a5cba2297eac4

SHA1
9fb9295c7eca4f9b4487a7be842b164f9c695e9c

SHA256
6a220d8e6bcbd9e93c95df2f1895ebeb68275126de045e173fd3a86825ed01f6

SHA512
de449ca7632f444fc35dc890b1ba091d15d2ff2d926f9ddd7eb2f9f168d5537566ccec9c73ecfd9c44c2ed86f44adde7066428ee5d3b7e11f8f1914558b84b13

Download Submit
\PROGRA~3\01476826\01476826.exe

Filesize
1011KB

MD5
b9ec5d1263ce730e0be1e8cf64c58cf4

SHA1
d30aab11a419fc105a15b9505dbeaa931d19c735

SHA256
d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

SHA512
60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0

Download Submit
memory/2104-1-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2104-2-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/2104-3-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2104-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2104-14-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-27-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-34-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/2660-21-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-24-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2660-25-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-23-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2660-26-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-32-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-33-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-22-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/2660-35-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-37-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-36-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2660-38-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-40-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-41-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-42-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-43-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2660-44-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads