c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68

General

Target

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Size

86KB
MD5

984a8b4ee6f5425191eeda95b1df5171
SHA1

bc86ab126d2e4bde6844cff5a7a03dcccec09be8
SHA256

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68
SHA512

b988b89aa9d542b9457941f2d4da3a7e457e5ec89eaecebc4a09cd0075ac92a6390d145cc17d7751c4832f2fe13dbf2640b1f7fff18497e5673c9de76f1f104e
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOVKbvVQFv2B9d:GhfxHNIreQm+HiuKbvVQFv2B9d

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rundll32.exe

pid process

2492 rundll32.exe

pid	process
2492	rundll32.exe

Loads dropped DLL 2 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

pid	process
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

description	ioc	process
File created	C:\Windows\SysWOW64\notepad¢¬.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
File opened for modification	C:\Windows\SysWOW64\¢«.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
File created	C:\Windows\SysWOW64\¢«.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

Drops file in Windows directory 2 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

description	ioc	process
File opened for modification	C:\Windows\system\rundll32.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
File created	C:\Windows\system\rundll32.exe	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

Modifies registry class 15 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716319086"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716319086"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

pid	process
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2492 rundll32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exerundll32.exe

pid process

1280 c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
2492 rundll32.exe
2492 rundll32.exe

pid	process
2492	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe

description	pid	process	target process
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe
PID 1280 wrote to memory of 2492	1280	c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe
"C:\Users\Admin\AppData\Local\Temp\c1b6d7387401e6e4646d9f13fa2b89c04e1871461f206335d37408fa21378a68.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\system\rundll32.exe
C:\Windows\system\rundll32.exe
2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe
Filesize
81KB

MD5
36b5dfbbdbde459a5e066ae0f0ee820d

SHA1
ef2dd2f980389ef03c47470cdd11b8b10f96a8c8

SHA256
3542608f44aaef00dc6f42b1d8b9f239554317bdd47a73b6aae235e5375f93af

SHA512
b29459ec1d1a84df3ffb86b40b527890f958c3d1429db45114f70b6171978f35d8c2c2b21c09a8fae5d6bacb03f57e2fa526da4c43a4f7f4d42ac49b42d6462a

Download Submit
\Windows\system\rundll32.exe
Filesize
73KB

MD5
a553c813d4d021c9f7853985a0b0eb92

SHA1
f0a22bb6af386a15747b8418c269ec55cbf3e6a3

SHA256
a132b776ef84775e242136254f57901fd0021b25bd1e0809e0be1454a4908f99

SHA512
22e11765fc3a355ae163a2c2442705b700c45e3742bb527f9c466d02b7dc7a59837d8bc44c12916c9397633b1235056829ba4c8ec2f5ea781dfefbef8b2812d9

Download Submit
memory/1280-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/1280-12-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/1280-17-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/1280-21-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/1280-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2492-19-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads