facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4

General

Target

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
Size

352KB
MD5

76dea90bde59f852c5f8f77b870ddcfb
SHA1

12e6d649b58f583497965c12e6a9eefea477c72c
SHA256

facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4
SHA512

8c7704e0815f224fd4e70fbe680793052846c58291de73590b846c0cd8b6e2971cb8c00817644293cdd129752663918caaafd50dd339d13bc271173bd13b63b8
SSDEEP

6144:QLcWkuzmQXbpobHVyC1XEWB++tSXje5iTmDXQECEqIlXSK+XMVOJj:JuzwHVf6cae5iTt2lCK+X

Score

9^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000f00000001e08c-137.dat	acprotect
behavioral2/files/0x000f00000001e08c-138.dat	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5060-132-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/5060-133-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/files/0x000f00000001e08c-137.dat	upx
behavioral2/files/0x000f00000001e08c-138.dat	upx
behavioral2/memory/3848-140-0x0000000010000000-0x0000000010085000-memory.dmp	upx
behavioral2/memory/5060-141-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3848	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msibqx32.dll,ssMdcLKWg"	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msibqx32.dll	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
File opened for modification	C:\Windows\SysWOW64\msibqx32.dll	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4668	5060	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3848	5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	86
PID 5060 wrote to memory of 3848	5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	86
PID 5060 wrote to memory of 3848	5060	facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe	86

C:\Users\Admin\AppData\Local\Temp\facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe
"C:\Users\Admin\AppData\Local\Temp\facde13e33a8f6485a42a53503d58913398d59b36a14f701c0bc26e8bdde4be4.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe msibqx32.dll,ssMdcLKWg
  2⤵
  - Loads dropped DLL
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 684
  2⤵
  - Program crash
  PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5060 -ip 5060
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msibqx32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
C:\Windows\SysWOW64\msibqx32.dll

Filesize
169KB

MD5
48518c28b28128f23428afac9d12d183

SHA1
abc163c73811703d3cf0c24da22986131905ca34

SHA256
2e1505794ad03265fa0a4c3ccb7a3dff7b3033cad9ed29297a98f7600b27cb8a

SHA512
991a88ad034432c10e7668f37f48444d78d69c4cb8b1b17d16036771c4b8e0fa3dbb42c061dd5c2baa7f00a787a95bb793f2d92308061e49a2554c4a5294aab0

Download Submit
memory/3848-140-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/5060-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/5060-133-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/5060-134-0x0000000002090000-0x00000000020EA000-memory.dmp

Filesize
360KB

Download
memory/5060-135-0x0000000002370000-0x00000000023F5000-memory.dmp

Filesize
532KB

Download
memory/5060-139-0x0000000002370000-0x00000000023F5000-memory.dmp

Filesize
532KB

Download
memory/5060-141-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing