bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028

General

Target
bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
Size 32KB
Sample220918-27slnsecc6
SHA256 bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028
MD5 483be6b1d187ca37a7d88c22e1b405c3
SHA1 8c10ea7abce72d8e7bb1140a64ebb2efa861a9f2
SHA512 1390269d0ef16cea11a4d8be4399ed1621adb54b6b7ba8d436e7a2452cae58edcc12e84381b3ca079bcdb0be5486a3554564de7b541c09a65d72a33cccca282d
SSDEEP 768:9UrXhwbleg3Bz/uRvA1ntAc2abTc8ua+7IM:9eIUABbu+jAc2MTcMiI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/452-135-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/452-137-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4516	rundll32.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\midimap.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\sysapp30.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\ksuser.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\msimg32.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4836	sc.exe
1096	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2952	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	84
PID 452 wrote to memory of 2952	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	84
PID 452 wrote to memory of 2952	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	84
PID 452 wrote to memory of 4836	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	85
PID 452 wrote to memory of 4836	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	85
PID 452 wrote to memory of 4836	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	85
PID 452 wrote to memory of 1096	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	86
PID 452 wrote to memory of 1096	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	86
PID 452 wrote to memory of 1096	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	86
PID 452 wrote to memory of 4516	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	89
PID 452 wrote to memory of 4516	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	89
PID 452 wrote to memory of 4516	452	bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe	89
PID 2952 wrote to memory of 4400	2952	net.exe	91
PID 2952 wrote to memory of 4400	2952	net.exe	91
PID 2952 wrote to memory of 4400	2952	net.exe	91

C:\Users\Admin\AppData\Local\Temp\bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
"C:\Users\Admin\AppData\Local\Temp\bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    PID:4400
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4836
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1663543622.dat, ServerMain c:\users\admin\appdata\local\temp\bb9e6a10d975371e5c72eb1ed9c106d1f581099c3231c4a439aac3582058a028.exe
  2⤵
  - Loads dropped DLL
  PID:4516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1663543622.dat

Path C:\Users\Admin\AppData\Local\Temp\1663543622.dat
Size 32KB
SHA256 76466d36d8f62a47bf8c84005f881d4776920d5f8fd936d7ce678756dbc9b5c8
MD5 1ffa5f5e4189ec83675c8ebfec5805c4
SHA1 ba3b3388465624dad302bfdddef8f5cbec49144c
SHA512 fb0d4433f70c698a4412bad5bcfd64ddb5386973eafdfecad895d8f1934c569bb418b958acdd6a8f6e139406c18670ad44546f0cb3f8928e629103059e5470a3
SSDEEP 768:iNZIOdkvndGZeiz3Sv7QWwyGqOKwRXndt:i3IOWfdgvzI7QWws0RNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

1663543622.dat

Path C:\Users\Admin\AppData\Local\Temp\1663543622.dat
Size 32KB
SHA256 76466d36d8f62a47bf8c84005f881d4776920d5f8fd936d7ce678756dbc9b5c8
MD5 1ffa5f5e4189ec83675c8ebfec5805c4
SHA1 ba3b3388465624dad302bfdddef8f5cbec49144c
SHA512 fb0d4433f70c698a4412bad5bcfd64ddb5386973eafdfecad895d8f1934c569bb418b958acdd6a8f6e139406c18670ad44546f0cb3f8928e629103059e5470a3
SSDEEP 768:iNZIOdkvndGZeiz3Sv7QWwyGqOKwRXndt:i3IOWfdgvzI7QWws0RNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-135-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/452-137-0x0000000000400000-0x0000000000416000-memory.dmp