strongpity | a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0

General

Target

a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
Size

2.3MB
MD5

1b924ee1c9630f3e580d99a0c7568f7a
SHA1

704849500748b97e63cf820f3b768ec4f91336d8
SHA256

a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0
SHA512

6c4cf6499dbdf8ca6a7815365e0a7ab687f2fcfd52cd4aab968487a7f85e01fbea51087db2710990e74671a5caf1682b05f19b367eda093433775dd72fef4da7

Score

10^/10

StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
stealer spyware strongpity

StrongPity Spyware 4 IoCs

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 5 IoCs

Loads dropped DLL 6 IoCs

pid	Process
860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
1392	svchosts32.exe
1392	svchosts32.exe
1380	spoolcl.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts32.exe	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
File created	C:\Windows\SysWOW64\spoolcl.exe	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1392	svchosts32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	svchosts32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2028	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	28
PID 860 wrote to memory of 2028	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	28
PID 860 wrote to memory of 2028	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	28
PID 860 wrote to memory of 2028	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	28
PID 860 wrote to memory of 580	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	29
PID 860 wrote to memory of 580	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	29
PID 860 wrote to memory of 580	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	29
PID 860 wrote to memory of 580	860	a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe	29
PID 1392 wrote to memory of 1380	1392	svchosts32.exe	31
PID 1392 wrote to memory of 1380	1392	svchosts32.exe	31
PID 1392 wrote to memory of 1380	1392	svchosts32.exe	31
PID 1392 wrote to memory of 1380	1392	svchosts32.exe	31
PID 1380 wrote to memory of 688	1380	spoolcl.exe	32
PID 1380 wrote to memory of 688	1380	spoolcl.exe	32
PID 1380 wrote to memory of 688	1380	spoolcl.exe	32
PID 1380 wrote to memory of 688	1380	spoolcl.exe	32

C:\Users\Admin\AppData\Local\Temp\a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe
"C:\Users\Admin\AppData\Local\Temp\a2035a826d94a0d9e63cb90f80acffd03caff3db6b73bf4e03fa84eddd8806b0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\winbox.exe
  "C:\Users\Admin\AppData\Local\Temp\winbox.exe"
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\SysWOW64\svchosts32.exe
  C:\Windows\system32\\svchosts32.exe help
  2⤵
  - Executes dropped EXE
  PID:580

memory/2028-59-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download