e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c

General

Target

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe
Size

65KB
MD5

97f73147e11abebfe25f5e6b4461d449
SHA1

e2b0f8f7511297b5da915096f9ac6eb4d057a6e0
SHA256

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c
SHA512

0ee3b2beca57d92ee5bf32f5d9d4ad3241dfb021a3eb65f0f63d92662ccbab3c09cf9ce5edb5c7fd6461783ef39801b044e51b29cd19b7b3ae95e1775b1bb146
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6W:Zr3Z5IfQIR81ad5yX6W

Score

9^/10

evasion

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
C:\Windows\Debug\ayahost.exe	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2992-5-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2668-6-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1692 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2484 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

ayahost.exe

pid process

2668 ayahost.exe

pid	process
1692	attrib.exe

pid	process
2484	cmd.exe

pid	process
2668	ayahost.exe

Drops file in Windows directory 3 IoCs

Processes:

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exeattrib.exe

description	ioc	process
File created	C:\Windows\Debug\ayahost.exe	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe

description pid process

Token: SeIncBasePriorityPrivilege 2992 e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe

description	pid	process	target process
PID 2992 wrote to memory of 1692	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	attrib.exe
PID 2992 wrote to memory of 1692	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	attrib.exe
PID 2992 wrote to memory of 1692	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	attrib.exe
PID 2992 wrote to memory of 1692	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	attrib.exe
PID 2992 wrote to memory of 2484	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	cmd.exe
PID 2992 wrote to memory of 2484	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	cmd.exe
PID 2992 wrote to memory of 2484	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	cmd.exe
PID 2992 wrote to memory of 2484	2992	e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1692 attrib.exe

pid	process
1692	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe
"C:\Users\Admin\AppData\Local\Temp\e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\ayahost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:1692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E036ED~1.EXE > nul
2⤵
- Deletes itself
PID:2484

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\ayahost.exe

Filesize
65KB

MD5
ffec8b875a52665a74cefd5ae51adb37

SHA1
55f444f9f7a3ed3e46a01f8c12d5d9dce318fa34

SHA256
2e1b0a9194018471ccf8fc6ae1081803f68242b3b193b5fb6a7ef0baa894abcc

SHA512
2a6b556e15c176dc4783dba45f336e612faf1491798f48b692d142289c16538ac72bcbb96e54c454af09e06a45bf40b95162438029c292c4dc6e5266a8168cf0

Download Submit
memory/2668-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2992-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2992-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads