6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e

General

Target

6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
Size

114KB
MD5

54a0bdcdec2f94a5bed9807ceebac37c
SHA1

786c8b86656fe8936ac6ea21c2b449d00e99af97
SHA256

6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e
SHA512

e3bcc4e12988a38405eea817a29bf695daae4a7e98221df88b1f5d1efc828f4723bce41f8aeb3f8b5e8fb354b7823942b26e9a96d84b7a3646e531851a937bca
SSDEEP

3072:HQC/yj5JO3MnfRG+Hu54Fx4xE8iOBDau8+fB8:wlj7cMnY+OEXVOBpc

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral1/memory/2984-0-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/files/0x000b000000014323-13.dat	UPX
behavioral1/memory/2984-12-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2652-19-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2312-26-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/3028-33-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/files/0x000c0000000146f8-29.dat	UPX
behavioral1/memory/2652-36-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2312-37-0x0000000000400000-0x000000000041B000-memory.dmp	UPX

Executes dropped EXE 4 IoCs

pid	Process
2652	MSWDM.EXE
2312	MSWDM.EXE
2548	6B75782992DEA5E8423BC41ABC78E137B27CC745EEA92FFE92B1BCA19F81066E.EXE
3028	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
2652	MSWDM.EXE
2652	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
File opened for modification	C:\Windows\devAE9.tmp	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
File opened for modification	C:\Windows\devAE9.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2652	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2312	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	28
PID 2984 wrote to memory of 2312	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	28
PID 2984 wrote to memory of 2312	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	28
PID 2984 wrote to memory of 2312	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	28
PID 2984 wrote to memory of 2652	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	29
PID 2984 wrote to memory of 2652	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	29
PID 2984 wrote to memory of 2652	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	29
PID 2984 wrote to memory of 2652	2984	6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe	29
PID 2652 wrote to memory of 2548	2652	MSWDM.EXE	30
PID 2652 wrote to memory of 2548	2652	MSWDM.EXE	30
PID 2652 wrote to memory of 2548	2652	MSWDM.EXE	30
PID 2652 wrote to memory of 2548	2652	MSWDM.EXE	30
PID 2652 wrote to memory of 3028	2652	MSWDM.EXE	32
PID 2652 wrote to memory of 3028	2652	MSWDM.EXE	32
PID 2652 wrote to memory of 3028	2652	MSWDM.EXE	32
PID 2652 wrote to memory of 3028	2652	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe
"C:\Users\Admin\AppData\Local\Temp\6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2984
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2312
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devAE9.tmp!C:\Users\Admin\AppData\Local\Temp\6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\6B75782992DEA5E8423BC41ABC78E137B27CC745EEA92FFE92B1BCA19F81066E.EXE
    3⤵
    - Executes dropped EXE
    PID:2548
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devAE9.tmp!C:\Users\Admin\AppData\Local\Temp\6B75782992DEA5E8423BC41ABC78E137B27CC745EEA92FFE92B1BCA19F81066E.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6B75782992DEA5E8423BC41ABC78E137B27CC745EEA92FFE92B1BCA19F81066E.EXE

Filesize
114KB

MD5
7758263189977a9b73c53c4350a10583

SHA1
75bd66600a8795f383ffbe51b10782a58cfbd129

SHA256
9b7a8753ee6d680643647d579ba1ec66025414a01aecae28e24a0d9beb5261cd

SHA512
2dca4e6d960862f8ddf5cb5b522b6aca7f598cd4bf319e7fdfe89abd7c9a0f81ca58557c1b6190e84e8db45ba5d9b6291aa960d10d049f86557fb54e63e4901d

Download Submit
C:\Windows\MSWDM.EXE

Filesize
80KB

MD5
b8c9ebcf6ee98708c25e20ff877c864b

SHA1
6968840eadc3376cd0243afabdbf111dd45302b0

SHA256
f1f296d62b677016042de988c677a890ae14806ac4c37ec102ac90fd77338898

SHA512
2a983bac3c82b78d9b9a94bbdf27cd07265b9c311a82521a8a2b379382bef08bec5b6acda8e67c65046ba4ffbb0c5cd9e2803b138efb43be2a2cb1a1ea14cdbc

Download Submit
\Users\Admin\AppData\Local\Temp\6b75782992dea5e8423bc41abc78e137b27cc745eea92ffe92b1bca19f81066e.exe

Filesize
34KB

MD5
f521965bf3c3f38dc3df43f0df339e95

SHA1
5ab377d59cb07f5d21fbe20418a4e0c9991ed570

SHA256
893c8af4fb2456a681b4c8106735323073cbcc7494353a8f0d4b087a4469d2f0

SHA512
c02c0593bc17c163a64d179877a47ed7896b1df719caa957c4586d00a42ce3cfbe46355a21a855290e5b5eb0b8566a70a9a35edf7e7ae6deec77f56501cdbdc2

Download Submit
memory/2312-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2312-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2652-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2652-36-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2652-27-0x00000000003D0000-0x00000000003EB000-memory.dmp

Filesize
108KB

Download
memory/2984-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2984-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3028-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads