2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b

General

Target

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
Size

2.3MB
MD5

432f7308d0e50349dc06923fa4abc2b3
SHA1

f82c340f36ebafc0de2027c94723c7e211ed8842
SHA256

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b
SHA512

085013587fb0f8842143778202ea3fad8e09a546270e17a291b5c8c6032d69e7772ce51776acba4194d28a9c999881fd0a44832c5a8858be2137c5a40a9efae7

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242
\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

IPADTV6.EXE

pid process

836 IPADTV6.EXE

pid	process
836	IPADTV6.EXE

Loads dropped DLL 2 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

pid	process
1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

Drops file in Program Files directory 1 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

description ioc process

File created C:\Program Files\IPADTV6.EXE 2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

description	ioc	process
File created	C:\Program Files\IPADTV6.EXE	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

Drops file in Windows directory 4 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
File created	C:\WINDOWS\Media\ActiveX.ocx	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

IPADTV6.EXE

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IPADTV6.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IPADTV6.EXE

NTFS ADS 3 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

pid process

1092 2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

IPADTV6.EXE

pid process

836 IPADTV6.EXE
836 IPADTV6.EXE

pid	process
836	IPADTV6.EXE
836	IPADTV6.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe

description	pid	process	target process
PID 1092 wrote to memory of 836	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	IPADTV6.EXE
PID 1092 wrote to memory of 836	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	IPADTV6.EXE
PID 1092 wrote to memory of 836	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	IPADTV6.EXE
PID 1092 wrote to memory of 836	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	IPADTV6.EXE
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe
PID 1092 wrote to memory of 1952	1092	2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe
"C:\Users\Admin\AppData\Local\Temp\2021f69b49cdd9d424e7a7cf3c42003dfe4bc03b9aef0141cd8043231f71b74b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files\IPADTV6.EXE
"C:\Program Files\IPADTV6.EXE"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
2⤵
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\IPADTV6.EXE
MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\Program Files\IPADTV6.EXE
MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\WINDOWS\Media\ActiveX.ocx
MD5
3831cb2f45f2a5de3425a698b73b0986

SHA1
8b0dabab62b3d688c6d776c0b117efd40abb784d

SHA256
c79b3755a2b8e2c1bb9e87c3027feb89893cb27c26ee82a9a3eb93e929293922

SHA512
128706f716a880a6bf4574a0ca01011972731d437e39d86246a3f0d26a73802754e61f399b8891ca48f6143ac0daca704e9812745885c5eb35ea2446888e0104

Download Submit
\Program Files\IPADTV6.EXE
MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
\Program Files\IPADTV6.EXE
MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
memory/836-62-0x0000000000000000-mapping.dmp

Download
memory/836-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1092-59-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1952-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads