f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b

Resubmissions

07-05-2024 12:36

240507-pta39afh8x 10

07-05-2024 12:36

07-05-2024 12:36

07-05-2024 12:36

07-05-2024 12:36

25-04-2024 13:15

Analysis

max time kernel
1190s
max time network
1205s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Size

1.8MB
MD5

74f0926d93b595bb0a97d12fcced1f0e
SHA1

057b3c704de258d5b858afc884495405af2c7426
SHA256

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b
SHA512

08f4b6a7ce8104180e538c2999115bc6cba33f3a66564db1b8369100bdbb540296207233cd25441c97f5ada1f4711c7ad4f12b18cc843ce0e9f719852444622a
SSDEEP

49152:VFqIJny8yP43p0p3PvdvN71jdII5rYjsAIGi:VFqmnbc45YVN71y1AGi

Score

10^/10

discovery motw persistence phishing upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
blindlicht.dumon.nl
Port:
21
Username:
[email protected]
Password:
tm2tojdi

Extracted

Credentials

Protocol: ftp
Host:
luiknatie.be
Port:
21
Username:
[email protected]
Password:
stefaan.verhelst

Extracted

Credentials

Protocol: ftp
Host:
systemhouse.be
Port:
21
Username:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
ftp.pulse-security.com
Port:
21
Username:
[email protected]
Password:
c.higgins

Extracted

Credentials

Protocol: ftp
Host:
ftp.pulse-security.com
Port:
21
Username:
adybawyw
Password:
c.higgins

Extracted

Credentials

Protocol: ftp
Host:
ftp.miil.cz
Port:
21
Username:
[email protected]
Password:
plzen1977

Extracted

Credentials

Protocol: ftp
Host:
ftp.pulse-security.com
Port:
21
Username:
admin
Password:
c.higgins

Extracted

Credentials

Protocol: ftp
Host:
ftp.kennelpoika.net
Port:
21
Username:
[email protected]
Password:
jari.nevalainen

Extracted

Credentials

Protocol: ftp
Host:
ftp.miil.cz
Port:
21
Username:
ionceh
Password:
plzen1977

Extracted

Credentials

Protocol: ftp
Host:
ftp.kennelpoika.net
Port:
21
Username:
20miumau00
Password:
jari.nevalainen

Extracted

Credentials

Protocol: ftp
Host:
ftp.pulse-security.com
Port:
21
Username:
pulse-security
Password:
c.higgins

Extracted

Credentials

Protocol: ftp
Host:
ftp.systemhouse.be
Port:
21
Username:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
ftp.miil.cz
Port:
21
Username:
admin
Password:
plzen1977

Extracted

Credentials

Protocol: ftp
Host:
ftp.kennelpoika.net
Port:
21
Username:
admin
Password:
jari.nevalainen

Extracted

Credentials

Protocol: ftp
Host:
ssh.miil.cz
Port:
21
Username:
miil
Password:
plzen1977

Extracted

Credentials

Protocol: ftp
Host:
ftp.systemhouse.be
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
ftp.kennelpoika.net
Port:
21
Username:
kennelpoika
Password:
jari.nevalainen

Extracted

Credentials

Protocol: ftp
Host:
ftp.systemhouse.be
Port:
21
Username:
systemhouse

Extracted

Credentials

Protocol: ftp
Host:
ftp.signalev.org
Port:
21
Username:
[email protected]
Password:
nikolaij.graudejus

Extracted

Credentials

Protocol: ftp
Host:
ftp.signalev.org
Port:
21
Username:
i8to5h1x2fmiq
Password:
nikolaij.graudejus

Extracted

Credentials

Protocol: ftp
Host:
ftp.signalev.org
Port:
21
Username:
admin
Password:
nikolaij.graudejus

Extracted

Credentials

Protocol: ftp
Host:
ftp.signalev.org
Port:
21
Username:
signalev
Password:
nikolaij.graudejus

Extracted

Credentials

Protocol: ftp
Host:
neueliebe.com
Port:
21
Username:
[email protected]
Password:
schillinger

Extracted

Credentials

Protocol: ftp
Host:
neueliebe.com
Port:
21
Username:
hossahossa
Password:
schillinger

Extracted

Credentials

Protocol: ftp
Host:
neueliebe.com
Port:
21
Username:
admin
Password:
schillinger

Extracted

Credentials

Protocol: ftp
Host:
neueliebe.com
Port:
21
Username:
neueliebe
Password:
schillinger

Extracted

Credentials

Protocol: ftp
Host:
especiallyforu.com
Port:
21
Username:
[email protected]
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
especiallyforu.com
Port:
21
Username:
lpatrick
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
especiallyforu.com
Port:
21
Username:
admin
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
especiallyforu.com
Port:
21
Username:
especiallyforu
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
ftp.especiallyforu.com
Port:
21
Username:
[email protected]
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
ftp.especiallyforu.com
Port:
21
Username:
lpatrick
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
ftp.especiallyforu.com
Port:
21
Username:
admin
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
ftp.especiallyforu.com
Port:
21
Username:
especiallyforu
Password:
lpatr.nytan

Extracted

Credentials

Protocol: ftp
Host:
asvoe-burgenland.at
Port:
21
Username:
[email protected]
Password:
berlakovich

Extracted

Credentials

Protocol: ftp
Host:
asvoe-burgenland.at
Port:
21
Username:
aaceac7b
Password:
berlakovich

Extracted

Credentials

Protocol: ftp
Host:
asvoe-burgenland.at
Port:
21
Username:
admin
Password:
berlakovich

Extracted

Credentials

Protocol: ftp
Host:
asvoe-burgenland.at
Port:
21
Username:
asvoe-burgenland
Password:
berlakovich

Extracted

Credentials

Protocol: ftp
Host:
vividprojects.de
Port:
21
Username:
[email protected]
Password:
|-Rjy/U58wUao=-|-|--

Extracted

Credentials

Protocol: ftp
Host:
vividprojects.de
Port:
21
Username:
joerg.meister
Password:
|-Rjy/U58wUao=-|-|--

Extracted

Credentials

Protocol: ftp
Host:
vividprojects.de
Port:
21
Username:
admin
Password:
|-Rjy/U58wUao=-|-|--

Extracted

Credentials

Protocol: ftp
Host:
vividprojects.de
Port:
21
Username:
vividprojects
Password:
|-Rjy/U58wUao=-|-|--

Extracted

Credentials

Protocol: ftp
Host:
ftp.adders.me.uk
Port:
21
Username:
[email protected]
Password:
adman56899

Extracted

Credentials

Protocol: ftp
Host:
ftp.adders.me.uk
Port:
21
Username:
99999-coco13
Password:
adman56899

Extracted

Credentials

Protocol: ftp
Host:
ftp.adders.me.uk
Port:
21
Username:
admin
Password:
adman56899

Extracted

Credentials

Protocol: ftp
Host:
ftp.adders.me.uk
Port:
21
Username:
adders
Password:
adman56899

Extracted

Credentials

Protocol: ftp
Host:
mail.zonab.rs
Port:
21
Username:
[email protected]
Password:
lacika09

Extracted

Credentials

Protocol: ftp
Host:
mail.zonab.rs
Port:
21
Username:
office
Password:
lacika09

Extracted

Credentials

Protocol: ftp
Host:
mail.zonab.rs
Port:
21
Username:
admin
Password:
lacika09

Extracted

Credentials

Protocol: ftp
Host:
ftp.fletchline.com
Port:
21
Username:
[email protected]
Password:
jeffshelton

Extracted

Credentials

Protocol: ftp
Host:
ftp.fletchline.com
Port:
21
Username:
barefoot19
Password:
jeffshelton

Extracted

Credentials

Protocol: ftp
Host:
mail.zonab.rs
Port:
21
Username:
zonab
Password:
lacika09

Extracted

Credentials

Protocol: ftp
Host:
ftp.fletchline.com
Port:
21
Username:
admin
Password:
jeffshelton

Extracted

Credentials

Protocol: ftp
Host:
ftp.fletchline.com
Port:
21
Username:
fletchline
Password:
jeffshelton

Extracted

Credentials

Protocol: ftp
Host:
tofuklops.de
Port:
21
Username:
[email protected]
Password:
59trick

Extracted

Credentials

Protocol: ftp
Host:
tofuklops.de
Port:
21
Username:
johunnes
Password:
59trick

Extracted

Credentials

Protocol: ftp
Host:
tofuklops.de
Port:
21
Username:
admin
Password:
59trick

Extracted

Credentials

Protocol: ftp
Host:
tofuklops.de
Port:
21
Username:
tofuklops
Password:
59trick

Extracted

Credentials

Protocol: ftp
Host:
ftp.bbull.com
Port:
21
Username:
[email protected]
Password:
murch294

Extracted

Credentials

Protocol: ftp
Host:
ftp.bbull.com
Port:
21
Username:
muinmuncluss08
Password:
murch294

Extracted

Credentials

Protocol: ftp
Host:
ftp.bbull.com
Port:
21
Username:
admin
Password:
murch294

Extracted

Credentials

Protocol: ftp
Host:
ftp.bbull.com
Port:
21
Username:
bbull
Password:
murch294

Extracted

Credentials

Protocol: ftp
Host:
ftp.jager.fr
Port:
21
Username:
[email protected]
Password:
fuck3rs

Extracted

Credentials

Protocol: ftp
Host:
ftp.jager.fr
Port:
21
Username:
bhiggins
Password:
fuck3rs

Extracted

Credentials

Protocol: ftp
Host:
ftp.jager.fr
Port:
21
Username:
admin
Password:
fuck3rs

Extracted

Credentials

Protocol: ftp
Host:
ftp.jager.fr
Port:
21
Username:
jager
Password:
fuck3rs

Extracted

Credentials

Protocol: ftp
Host:
gatti.fr
Port:
21
Username:
[email protected]
Password:
isabella123gatti

Extracted

Credentials

Protocol: ftp
Host:
gatti.fr
Port:
21
Username:
bella
Password:
isabella123gatti

Extracted

Credentials

Protocol: ftp
Host:
gatti.fr
Port:
21
Username:
admin
Password:
isabella123gatti

Extracted

Credentials

Protocol: ftp
Host:
gatti.fr
Port:
21
Username:
gatti
Password:
isabella123gatti

Extracted

Credentials

Protocol: ftp
Host:
fout-vonal.hu
Port:
21
Username:
[email protected]
Password:
kecso.tamas

Extracted

Credentials

Protocol: ftp
Host:
fout-vonal.hu
Port:
21
Username:
mtiyod
Password:
kecso.tamas

Extracted

Credentials

Protocol: ftp
Host:
fout-vonal.hu
Port:
21
Username:
admin
Password:
kecso.tamas

Extracted

Credentials

Protocol: ftp
Host:
fout-vonal.hu
Port:
21
Username:
fout-vonal
Password:
kecso.tamas

Extracted

Credentials

Protocol: ftp
Host:
gcontrol.net
Port:
21
Username:
[email protected]
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
gcontrol.net
Port:
21
Username:
nlol6hh
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
gcontrol.net
Port:
21
Username:
admin
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
gcontrol.net
Port:
21
Username:
gcontrol
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
ftp.gcontrol.net
Port:
21
Username:
[email protected]
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
ftp.gcontrol.net
Port:
21
Username:
nlol6hh
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
ftp.gcontrol.net
Port:
21
Username:
admin
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
ftp.gcontrol.net
Port:
21
Username:
gcontrol
Password:
bgildersleeve

Extracted

Credentials

Protocol: ftp
Host:
la-colline.nl
Port:
21
Username:
[email protected]
Password:
gertjordaans

Extracted

Credentials

Protocol: ftp
Host:
ssh.udllc.net
Port:
21
Username:
[email protected]
Password:
10011001

Extracted

Credentials

Protocol: ftp
Host:
ssh.udllc.net
Port:
21
Username:
postmaster
Password:
10011001

Extracted

Credentials

Protocol: ftp
Host:
ssh.udllc.net
Port:
21
Username:
admin
Password:
10011001

Extracted

Credentials

Protocol: ftp
Host:
ssh.udllc.net
Port:
21
Username:
udllc
Password:
10011001

Extracted

Credentials

Protocol: ftp
Host:
somethingfunny.net
Port:
21
Username:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
somethingfunny.net
Port:
21
Username:
hcrpporj

Extracted

Credentials

Protocol: ftp
Host:
somethingfunny.net
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
somethingfunny.net
Port:
21
Username:
somethingfunny

Extracted

Credentials

Protocol: ftp
Host:
hiddenvintage.com
Port:
21
Username:
[email protected]
Password:
natasha

Extracted

Credentials

Protocol: ftp
Host:
fonderiapovolaro.com
Port:
21
Username:
[email protected]
Password:
M2FG8NF

Extracted

Credentials

Protocol: ftp
Host:
hiddenvintage.com
Port:
21
Username:
hidden
Password:
natasha

Extracted

Credentials

Protocol: ftp
Host:
fonderiapovolaro.com
Port:
21
Username:
office
Password:
M2FG8NF

Extracted

Credentials

Protocol: ftp
Host:
fonderiapovolaro.com
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
fonderiapovolaro.com
Port:
21
Username:
fonderiapovolaro
Password:
M2FG8NF

Extracted

Credentials

Protocol: ftp
Host:
ftp.fonderiapovolaro.com
Port:
21
Username:
[email protected]
Password:
M2FG8NF

Extracted

Credentials

Protocol: ftp
Host:
protectasolutions.be
Port:
21
Username:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
protectasolutions.be
Port:
21
Username:
office

Extracted

Credentials

Protocol: ftp
Host:
protectasolutions.be
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
protectasolutions.be
Port:
21
Username:
protectasolutions

Extracted

Credentials

Protocol: ftp
Host:
ftp.protectasolutions.be
Port:
21
Username:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
ftp.protectasolutions.be
Port:
21
Username:
office

Extracted

Credentials

Protocol: ftp
Host:
ftp.protectasolutions.be
Port:
21
Username:
protectasolutions

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (887) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2536-1-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-32-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-117-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-114-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-112-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-111-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-116-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-115-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-113-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2536-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 8 IoCs

phishing motw

Processes:

flow	ioc
64940	http://www.mopro.com/errorPage.aspx?error=404
64962	http://www.mopro.com/errorPage.aspx?error=404
64979	http://www.mopro.com/errorPage.aspx?error=404
64889	http://www.mopro.com/errorPage.aspx?error=404
65029	http://www.mopro.com/errorPage.aspx?error=404
65022	http://www.mopro.com/errorPage.aspx?error=404
64884	http://www.mopro.com/errorPage.aspx?error=404
65070	http://www.mopro.com/errorPage.aspx?error=404

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

description	pid	process	target process
PID 464 set thread context of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

pid	process
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
2536	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

description	pid	process	target process
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
PID 464 wrote to memory of 2536	464	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe	f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.4MB

MD5
0ce4530144899e61e7151afe7810919f

SHA1
f300561ff8bbd2b426926aced1e576bd2b91d001

SHA256
59f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5

SHA512
595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
8.9MB

MD5
f5a8a288e66eb8b88bc7b09942493e7c

SHA1
d31f1365f436ad9555b569a1b487e75dc1db7d83

SHA256
477a546d82cb7277fa99cf0ce41cce516cea4d7c3f1be8dbb4f28969dbef4d06

SHA512
5d689ff6e5f7df099adb1af87ef797a8255bd39de1f8d8acfaf7a1c29c214957149fde3b44468213e8ebfed8eb4c83b05a40dbad41f41841766f8b35a7ea0323

Download Submit
memory/464-5-0x0000000004DC0000-0x0000000004F77000-memory.dmp

Filesize
1.7MB

Download
memory/464-2-0x0000000004BF0000-0x0000000004DB1000-memory.dmp

Filesize
1.8MB

Download
memory/2536-1-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-32-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-117-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-114-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-112-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-111-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-116-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-115-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-113-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2536-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download