6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398

General

Target

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Size

128KB
MD5

0853840bd78999fb653966990875e2d0
SHA1

42431b86ab78710bd94ec53f2a631b114270c608
SHA256

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398
SHA512

670d7f196606437d5971f8f6759cb661f9d1d3e70eb0bacf6423ad87bdf90da99093119f4dc9f9170499722c2e500183469f2be5c7b70a7e657223356c1ab93a
SSDEEP

3072:S1l978RGcSroM8ieIN908uFafmHURHAVgnvedh6:ED78RGroxiz908uF8YU8gnve7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

Executes dropped EXE 1 IoCs

Processes:

Iagfoe32.exe

pid process

3012 Iagfoe32.exe

pid	process
3012	Iagfoe32.exe

Loads dropped DLL 6 IoCs

Processes:

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exeWerFault.exe

pid	process
2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
2256	WerFault.exe
2256	WerFault.exe
2256	WerFault.exe
2256	WerFault.exe

Drops file in System32 directory 3 IoCs

Processes:

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Gjenmobn.dll	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
File created	C:\Windows\SysWOW64\Iagfoe32.exe	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
File opened for modification	C:\Windows\SysWOW64\Iagfoe32.exe	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2256 3012 WerFault.exe Iagfoe32.exe

pid	pid_target	process	target process
2256	3012	WerFault.exe	Iagfoe32.exe

Modifies registry class 6 IoCs

Processes:

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjenmobn.dll"	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exeIagfoe32.exe

description	pid	process	target process
PID 2908 wrote to memory of 3012	2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe	Iagfoe32.exe
PID 2908 wrote to memory of 3012	2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe	Iagfoe32.exe
PID 2908 wrote to memory of 3012	2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe	Iagfoe32.exe
PID 2908 wrote to memory of 3012	2908	6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe	Iagfoe32.exe
PID 3012 wrote to memory of 2256	3012	Iagfoe32.exe	WerFault.exe
PID 3012 wrote to memory of 2256	3012	Iagfoe32.exe	WerFault.exe
PID 3012 wrote to memory of 2256	3012	Iagfoe32.exe	WerFault.exe
PID 3012 wrote to memory of 2256	3012	Iagfoe32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe
"C:\Users\Admin\AppData\Local\Temp\6932aa1620adaf79a22126660707ab14e68f5a48b13b442b3ece1f81c02a9398.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\Iagfoe32.exe
C:\Windows\system32\Iagfoe32.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 140
3⤵
- Loads dropped DLL
- Program crash
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Iagfoe32.exe

Filesize
128KB

MD5
a80c755f7c44b611295920e568445e63

SHA1
4e21555a40acaf0bf6ad3c654c8b578131f6ef73

SHA256
80bbdd231830f8536724decf49c1a97a5b3397e1cef9ea9dc64825e6fa73c5b3

SHA512
0a7e92c86f58ab14775a283866985f9f821eaf4ddc7dcdfb587408a3a7eca624ca46d5218f0716fb3a5084b6ac5bd2b9eb2828ec1bb6fb6e365cf2cf50f2248c

Download Submit
memory/2908-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2908-6-0x0000000000450000-0x0000000000495000-memory.dmp

Filesize
276KB

Download
memory/2908-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads