a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f

General

Target

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
Size

367KB
MD5

672ecfcf909137d87d6f47c7ef118143
SHA1

7fb750b80185880f82d7a5c2da4729f6ff2738b9
SHA256

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f
SHA512

62bd11f50ec9a1cff0a456106c58b159cda2b850072137442dadfbf2d31751d7443e4020b24a6512e78669f3bef77ec8a063455a3235429bdaa70be622d65ba5
SSDEEP

6144:W5vdoxEelLNFIJmblgragFfHBGwx6tGNO1wSUs7m2dMdsjHRS4U1P7QMPwHAYOBa:u9eXFlqzvJYgO1wSRmqMdsjxyF78H

Score

9^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\msilca32.dll	acprotect
C:\Windows\SysWOW64\msilca32.dll	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1308-132-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/1308-133-0x0000000000400000-0x000000000046B000-memory.dmp	upx
C:\Windows\SysWOW64\msilca32.dll	upx
C:\Windows\SysWOW64\msilca32.dll	upx
behavioral2/memory/4284-141-0x0000000010000000-0x0000000010086000-memory.dmp	upx
behavioral2/memory/1308-142-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4284 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4284	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msilca32.dll,SxUtbDcZJaaA"	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msilca32.dll	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
File opened for modification	C:\Windows\SysWOW64\msilca32.dll	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

892 1308 WerFault.exe a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

pid	pid_target	process	target process
892	1308	WerFault.exe	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

pid	process
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe

description	pid	process	target process
PID 1308 wrote to memory of 4284	1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe	rundll32.exe
PID 1308 wrote to memory of 4284	1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe	rundll32.exe
PID 1308 wrote to memory of 4284	1308	a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe
"C:\Users\Admin\AppData\Local\Temp\a0c32a0ba5d6badb06416352e0c3c060e16f65546444a1bd2aaf9e40a401608f.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe msilca32.dll,SxUtbDcZJaaA
2⤵
- Loads dropped DLL
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 660
2⤵
- Program crash
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1308 -ip 1308
1⤵
PID:1616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msilca32.dll
Filesize
172KB

MD5
f3e7fd27bc42145aec4b693e57d4190f

SHA1
38491c0a71965fcaa6d35e762cd191038cf9d463

SHA256
744ade606121787d93fc3d2dd1cb8fea24a71d4e1d378fedbb56228006db79b9

SHA512
4df998bd10dcdad3447ff7d852bb491e87d161ffbba7d99dddc6adc2e64c2e2a4de52f1cd14bdf52bf4951df347cd6d6e88e7215ec9e1ca6e72294e88ba32802

Download Submit
C:\Windows\SysWOW64\msilca32.dll
Filesize
172KB

MD5
f3e7fd27bc42145aec4b693e57d4190f

SHA1
38491c0a71965fcaa6d35e762cd191038cf9d463

SHA256
744ade606121787d93fc3d2dd1cb8fea24a71d4e1d378fedbb56228006db79b9

SHA512
4df998bd10dcdad3447ff7d852bb491e87d161ffbba7d99dddc6adc2e64c2e2a4de52f1cd14bdf52bf4951df347cd6d6e88e7215ec9e1ca6e72294e88ba32802

Download Submit
memory/1308-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1308-133-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1308-134-0x0000000000BE0000-0x0000000000C3A000-memory.dmp

Filesize
360KB

Download
memory/1308-135-0x0000000002920000-0x00000000029A6000-memory.dmp

Filesize
536KB

Download
memory/1308-136-0x0000000000BE0000-0x0000000000C3A000-memory.dmp

Filesize
360KB

Download
memory/1308-137-0x0000000002920000-0x00000000029A6000-memory.dmp

Filesize
536KB

Download
memory/1308-142-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1308-143-0x0000000002920000-0x00000000029A6000-memory.dmp

Filesize
536KB

Download
memory/4284-138-0x0000000000000000-mapping.dmp

Download
memory/4284-141-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads