Overview

overview

10

Static

static

8

04443c70d3...be.exe

windows7_x64

9

04443c70d3...be.exe

windows10_x64

9

05535d72f3...06.exe

windows7_x64

1

05535d72f3...06.exe

windows10_x64

1

1bec139d54...72.exe

windows7_x64

8

1bec139d54...72.exe

windows10_x64

8

1f670ff8cc...55.exe

windows7_x64

1

1f670ff8cc...55.exe

windows10_x64

1

2deaa0ec74...ea.exe

windows7_x64

10

2deaa0ec74...ea.exe

windows10_x64

10

372b929ae9...ef.dll

windows7_x64

9

372b929ae9...ef.dll

windows10_x64

9

38ee6bea62...15.exe

windows7_x64

3

38ee6bea62...15.exe

windows10_x64

3

437d91ce52...8f.exe

windows7_x64

1

437d91ce52...8f.exe

windows10_x64

4

447058c1c6...a8.exe

windows7_x64

9

447058c1c6...a8.exe

windows10_x64

9

5061c0b08d...03.exe

windows7_x64

1

5061c0b08d...03.exe

windows10_x64

1

5ed4b682ef...d4.exe

windows7_x64

8

5ed4b682ef...d4.exe

windows10_x64

8

6970600d21...b5.exe

windows7_x64

1

6970600d21...b5.exe

windows10_x64

1

72f528f9a6...92.exe

windows7_x64

8

72f528f9a6...92.exe

windows10_x64

8

73dcee7abe...99.exe

windows7_x64

1

73dcee7abe...99.exe

windows10_x64

1

7e118b534a...d2.exe

windows7_x64

10

7e118b534a...d2.exe

windows10_x64

10

8034fffb03...3c.exe

windows7_x64

10

8034fffb03...3c.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll

  • Size

    846KB

  • MD5

    85003057fbddd3468478adc04a1b50cd

  • SHA1

    acdd39a0d8068bfc4a16a0193c90eae85a5831fa

  • SHA256

    372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef

  • SHA512

    989f0738855e83b3ec9d97a7c9f93c0362285393cb1b7a266d6d1287bffad97c3a674c1738d1d0dc32c9751f68025da34f176a9bcc81c27b39fc1accdbbabb06

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Blocklisted process makes network request 5 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2896
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\372b929ae9362bf357a3a8c5c968921f2c950094d928b2ed2cf94ea04bcfdbef.dll,#1
          3⤵
          • Blocklisted process makes network request
          • Drops file in Drivers directory
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: LoadsDriver
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4744

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    3
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\GGAAwsIy.dll
      MD5

      c637559fada3fe53e5a6f8dcc0a5bf4f

      SHA1

      265af8613fef8024190e6e49b1b24cf34060d86b

      SHA256

      9d7fc881646ba2db7023ed8f0857c1a82df0d81ebef839d20063a027fe4b9e7d

      SHA512

      fc0a32bb05b3b4ff96382d0c3d1857b1eb70c4e9030073c33579998f1fca40c8dcd6b2960c329c9845af5aa245566577198fa18e9c1985850038e84af1ac56ce

      Download Submit
    • \Users\Admin\AppData\Local\Temp\mxloxqt.dll
      MD5

      2d97d64720ba391542418c755d3e98e6

      SHA1

      5fcc2a28d4676ba65231321f16b3cc222b9bfd99

      SHA256

      29533c9c074b9c54ecc6cefa332ef481c6c2e14c52ea5054379474347e23a3f3

      SHA512

      278e49c05b88f218fa9d0a60c5a66e2b1583044a5b3e3d3fb7a9f9b4892fe2802d107dc001420e9c3a00c98b957ed70a648a802392bb2ee296d6ef2072b7bce0

      Download Submit
    • memory/4744-2-0x0000000000000000-mapping.dmp
      Download
    • memory/4744-4-0x0000000000A80000-0x0000000000A83000-memory.dmp
      Filesize

      12KB

      Download