0b416f2db255c5c45d5631030a82bc5501d7d890bddd911020fefa74daa31f4d

General

Target
761EDF12D3A9BCAFBC7A1DB77E324241.exe
Size 3.5MB
Sample260321-mj55jacz8k
SHA256 0b416f2db255c5c45d5631030a82bc5501d7d890bddd911020fefa74daa31f4d
MD5 761edf12d3a9bcafbc7a1db77e324241
SHA1 28e6306524feba79041731d5a99ed58fd184a1ad
SHA512 16381c193ba15952db04958cd928e598395fe05dfb4c8f2b36877ef0a6fe0caccba86b899b5f66e924d227034e7c48965226ac66f2445fbd3d4d2fe974b65cf4
SSDEEP 49152:2VUBAJWgVUlsHjkmiGWU5+5WeLGpMZ7iKPfg+DTeC:iJWgVUuHjkDGjYQeqpgmd6e
TLSH
T1CC06DF44BBD4CA1BE5AF87B6B4F246120775EC15E792E70B199037B81CB37042D293AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5116	761EDF12D3A9BCAFBC7A1DB77E324241.exe
1988	761EDF12D3A9BCAFBC7A1DB77E324241.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5136	timeout.exe
5036	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2412	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4288	1316	761EDF12D3A9BCAFBC7A1DB77E324241.exe	78
PID 4288 wrote to memory of 5060	4288	cmd.exe	80
PID 4288 wrote to memory of 5136	4288	cmd.exe	81
PID 4288 wrote to memory of 5116	4288	cmd.exe	82
PID 4288 wrote to memory of 5036	4288	cmd.exe	83
PID 5116 wrote to memory of 2412	5116	761EDF12D3A9BCAFBC7A1DB77E324241.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\761EDF12D3A9BCAFBC7A1DB77E324241.exe
"C:\Users\Admin\AppData\Local\Temp\761EDF12D3A9BCAFBC7A1DB77E324241.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_KaqodA0nbNWS2YjxLspRM5bXvyaysd.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5060
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5136
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "761EDF12D3A9BCAFBC7A1DB77E324241" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2412
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5036

C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe"
1⤵
- Executes dropped EXE
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

761EDF12D3A9BCAFBC7A1DB77E324241.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\761EDF12D3A9BCAFBC7A1DB77E324241.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

761EDF12D3A9BCAFBC7A1DB77E324241.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\761EDF12D3A9BCAFBC7A1DB77E324241.exe
Size 3.5MB
SHA256 0b416f2db255c5c45d5631030a82bc5501d7d890bddd911020fefa74daa31f4d
MD5 761edf12d3a9bcafbc7a1db77e324241
SHA1 28e6306524feba79041731d5a99ed58fd184a1ad
SHA512 16381c193ba15952db04958cd928e598395fe05dfb4c8f2b36877ef0a6fe0caccba86b899b5f66e924d227034e7c48965226ac66f2445fbd3d4d2fe974b65cf4
SSDEEP 49152:2VUBAJWgVUlsHjkmiGWU5+5WeLGpMZ7iKPfg+DTeC:iJWgVUuHjkDGjYQeqpgmd6e
TLSH
T1CC06DF44BBD4CA1BE5AF87B6B4F246120775EC15E792E70B199037B81CB37042D293AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_KaqodA0nbNWS2YjxLspRM5bXvyaysd.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_KaqodA0nbNWS2YjxLspRM5bXvyaysd.bat
Size 630B
SHA256 e70753d75b17570b49cd1dec80e6d5750b2868a23a05022c19b7f3b09f6f4985
MD5 9933d05fe67b334d9ec16d1378af8bf5
SHA1 5868de7a8c39b777fa88b52c3db780a68c4869b3
SHA512 1166e11b059935860fe974dd846389406cdb272200c5ce0b5355c5d246334e831860fcfa7581a229ae4da5b2fac98b8d51455a635863c19241b3db8dbb53eb43
TLSH
T181F02B11628E4E572D1090775ABF228E82D54093AF9965403F18C51E878340E91A32D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1316-0-0x0000022BCDB90000-0x0000022BCDF1C000-memory.dmp

Download

memory/1316-1-0x0000022BCE370000-0x0000022BCE380000-memory.dmp

Download

memory/1316-2-0x0000022BCE340000-0x0000022BCE348000-memory.dmp

Download

memory/5116-13-0x000001FA7E5A0000-0x000001FA7E5B0000-memory.dmp

Download

memory/5116-15-0x000001FA7E5A0000-0x000001FA7E5B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads