strongpity | 835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416

General

Target

835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe
Size

28.4MB
MD5

1070495a068632647e756a9209a42ac2
SHA1

1044ef843ed83450ffa3238694db5c6e1d785f39
SHA256

835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416
SHA512

8c73e8999f06d4f3a38748ecce10bd43e03e41637355a60a3a9324cb033b9dcbe7415cf153f20192f296099dd408462a2fa01ccbd453eebaae2f634bb42cddf9

Score

10^/10

StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
stealer spyware strongpity

StrongPity Spyware 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab35-123.dat	family_strongpity
behavioral2/files/0x000500000001ab35-124.dat	family_strongpity

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 5 IoCs

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dusntask.exe	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe
File created	C:\Windows\SysWOW64\ngentask.exe	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	dusntask.exe
4204	dusntask.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	WinSetupFromUSB-1-9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2160	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	69
PID 3676 wrote to memory of 2160	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	69
PID 3676 wrote to memory of 2160	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	69
PID 3676 wrote to memory of 3976	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	70
PID 3676 wrote to memory of 3976	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	70
PID 3676 wrote to memory of 3976	3676	835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe	70
PID 4204 wrote to memory of 4172	4204	dusntask.exe	72
PID 4204 wrote to memory of 4172	4204	dusntask.exe	72
PID 4204 wrote to memory of 4172	4204	dusntask.exe	72
PID 4172 wrote to memory of 1736	4172	ngentask.exe	73
PID 4172 wrote to memory of 1736	4172	ngentask.exe	73
PID 4172 wrote to memory of 1736	4172	ngentask.exe	73

C:\Users\Admin\AppData\Local\Temp\835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe
"C:\Users\Admin\AppData\Local\Temp\835a545fe93bfa75931079ef36169bfc56906f74b9b9862848ff79534b33f416.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\WinSetupFromUSB-1-9.exe
  "C:\Users\Admin\AppData\Local\Temp\WinSetupFromUSB-1-9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:2160
- C:\Windows\SysWOW64\dusntask.exe
  C:\Windows\system32\\dusntask.exe help
  2⤵
  - Executes dropped EXE
  PID:3976