421b0ef1c2a88cd4748fc910f2ae7ccf92070bc8bf85884282eadb64b1ee78e2

General

Target

file.exe
Size

804KB
MD5

231b50057ad6ffccd5144a9b09b6c7ef
SHA1

c690fd7646ed42338113a58c1c373fc55d6aa5b8
SHA256

421b0ef1c2a88cd4748fc910f2ae7ccf92070bc8bf85884282eadb64b1ee78e2
SHA512

dd861316f7294ea53ce1f09c3b444e94decb840359ad98c9449d52ca077e93058c66ba0027b62cbab31b6b6102db7d24517061d85a8873e3f706aabef08388eb
SSDEEP

12288:3Sx14GBK5SYHdZPyhaJm0PoNDNu9H/MLZZTxKO4789RmAz7tlud:3SmSHlNaH/MLZZ9KO4PAvt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 2872	2532	file.exe	31
PID 2872 set thread context of 1212	2872	file.exe	21
PID 2872 set thread context of 2604	2872	file.exe	32
PID 2604 set thread context of 1212	2604	convert.exe	21

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	convert.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2532	file.exe
2532	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2872	file.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe
2604	convert.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2872	file.exe
1212	Explorer.EXE
1212	Explorer.EXE
2604	convert.exe
2604	convert.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 2532 wrote to memory of 2872	2532	file.exe	31
PID 1212 wrote to memory of 2604	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2604	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2604	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2604	1212	Explorer.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2872
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\SysWOW64\convert.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-21-0x0000000009A40000-0x000000000AD8D000-memory.dmp

Filesize
19.3MB

Download
memory/1212-29-0x0000000009A40000-0x000000000AD8D000-memory.dmp

Filesize
19.3MB

Download
memory/2532-4-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/2532-15-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-2-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-5-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/2532-6-0x0000000004D80000-0x0000000004E0A000-memory.dmp

Filesize
552KB

Download
memory/2532-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000001290000-0x0000000001360000-memory.dmp

Filesize
832KB

Download
memory/2532-3-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/2604-27-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2604-26-0x00000000023C0000-0x00000000026C3000-memory.dmp

Filesize
3.0MB

Download
memory/2604-28-0x00000000029A0000-0x0000000002A41000-memory.dmp

Filesize
644KB

Download
memory/2604-23-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2604-30-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2604-22-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2872-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-20-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/2872-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-17-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/2872-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-25-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/2872-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2872-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing