facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4

General

Target

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
Size

352KB
MD5

76dea90bde59f852c5f8f77b870ddcfb
SHA1

12e6d649b58f583497965c12e6a9eefea477c72c
SHA256

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4
SHA512

8c7704e0815f224fd4e70fbe680793052846c58291de73590b846c0cd8b6e2971cb8c00817644293cdd129752663918caaafd50dd339d13bc271173bd13b63b8
SSDEEP

6144:QLcWkuzmQXbpobHVyC1XEWB++tSXje5iTmDXQECEqIlXSK+XMVOJj:JuzwHVf6cae5iTt2lCK+X

Score

9^/10

collection discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\msibmg32.dll	acprotect
\Windows\SysWOW64\msibmg32.dll	acprotect
\Windows\SysWOW64\msibmg32.dll	acprotect
\Windows\SysWOW64\msibmg32.dll	acprotect
\Windows\SysWOW64\msibmg32.dll	acprotect

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1624-55-0x0000000000400000-0x000000000046B000-memory.dmp	upx
C:\Windows\SysWOW64\msibmg32.dll	upx
\Windows\SysWOW64\msibmg32.dll	upx
\Windows\SysWOW64\msibmg32.dll	upx
\Windows\SysWOW64\msibmg32.dll	upx
\Windows\SysWOW64\msibmg32.dll	upx
behavioral1/memory/1756-68-0x0000000010000000-0x0000000010085000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1756 rundll32.exe
1756 rundll32.exe
1756 rundll32.exe
1756 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msibmg32.dll,ssMdcLKWg"	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\msibmg32.dll	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
File created	C:\Windows\SysWOW64\msibmg32.dll	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

960 1624 WerFault.exe facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

pid	pid_target	process	target process
960	1624	WerFault.exe	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

pid	process
1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

description	pid	process	target process
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 1756	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	rundll32.exe
PID 1624 wrote to memory of 960	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	WerFault.exe
PID 1624 wrote to memory of 960	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	WerFault.exe
PID 1624 wrote to memory of 960	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	WerFault.exe
PID 1624 wrote to memory of 960	1624	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	WerFault.exe

outlook_win_path 1 IoCs

Processes:

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

C:\Users\Admin\AppData\Local\Temp\facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
"C:\Users\Admin\AppData\Local\Temp\facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe msibmg32.dll,ssMdcLKWg
  2⤵
  - Loads dropped DLL
  PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 340
  2⤵
  - Program crash
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msibmg32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
\Windows\SysWOW64\msibmg32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
\Windows\SysWOW64\msibmg32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
\Windows\SysWOW64\msibmg32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
\Windows\SysWOW64\msibmg32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
memory/960-62-0x0000000000000000-mapping.dmp

Download
memory/1624-57-0x0000000002290000-0x0000000002315000-memory.dmp

Filesize
532KB

Download
memory/1624-61-0x0000000000320000-0x000000000037A000-memory.dmp

Filesize
360KB

Download
memory/1624-58-0x0000000002290000-0x0000000002315000-memory.dmp

Filesize
532KB

Download
memory/1624-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1624-56-0x0000000000320000-0x000000000037A000-memory.dmp

Filesize
360KB

Download
memory/1624-55-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1624-69-0x0000000002290000-0x0000000002315000-memory.dmp

Filesize
532KB

Download
memory/1756-59-0x0000000000000000-mapping.dmp

Download
memory/1756-68-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads