890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234

General

Target

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Size

453KB
MD5

4c9b1ced2955f80a42c3c9b5613f984f
SHA1

1a5c4f30c9ad3f1d683bcbe79580a0ba4fbc0c9b
SHA256

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234
SHA512

fc095d5111a3d5e03eedf2ea4f480ef4d312d81f20f15d6a74eefbc30750d5fc81cc0905b87ae9e041871e0387e59c69a30ec2b9ed0dd0b222e9f37ea0152da3
SSDEEP

12288:MI+U9rUSqIOtxnTir5xmXhq+NmJepW1K3DnsxJ84g2L:jBrUSrITir5xEhW4Ds42L

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5088-137-0x00000000007F0000-0x00000000007FF000-memory.dmp	upx
behavioral2/memory/5088-139-0x00000000007F0000-0x00000000007FF000-memory.dmp	upx
behavioral2/memory/5088-143-0x00000000007F0000-0x00000000007FF000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

pid process

5088 890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Modifies registry class 38 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\TypeLib\ = "{76893324-025B-12E8-664C-54BCC096FF3D}"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\InprocServer32	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\ProgID	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win64\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\FLAGS\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\Programmable	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win32\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win64	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\ = "Microsoft ActiveX Data Objects 2.7 Library"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\VersionIndependentProgID	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win32	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\Version	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\TypeLib\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\VersionIndependentProgID\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\ProgID\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado27.tlb"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\0\win64\ = "C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\TypeLib	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\VersionIndependentProgID\ = "HNetCfg.NATUPnP"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\ProgID\ = "HNetCfg.NATUPnP.1"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\Programmable\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\FLAGS	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}\2.7\FLAGS\ = "0"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\Version\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\InprocServer32\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76893324-025B-12E8-664C-54BCC096FF3D}	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\ = "Lapinidzi.Oqeta.Hafozeqo Object"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\InprocServer32\ = "%SystemRoot%\\SysWow64\\hnetcfg.dll"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79B6AB0-1754-43F3-BDA2-8019D2993EA7}\Version\ = "1.0"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

pid	process
5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description	pid	process	target process
PID 5088 wrote to memory of 1380	5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe
PID 5088 wrote to memory of 1380	5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe
PID 5088 wrote to memory of 1380	5088	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
"C:\Users\Admin\AppData\Local\Temp\890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd
2⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
10KB

MD5
28a57355d9583b66e51ad978384c159e

SHA1
b8fe4ddb6187cdee0e89c02bab4a104f406d16da

SHA256
81ed76156df0de1caae6730a091f29978493881b54a2d6fbfb43c47153b6fadd

SHA512
991a288ed0f033eb8f54e567a6264a6111f795bd61a1cd600e210730d7ed39c89e735480dc6f0e4026eafad730ae8dc23ec7bc7600a14a2ac9d652638c02ee3e

Download Submit
memory/1380-135-0x0000000000000000-mapping.dmp

Download
memory/5088-133-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/5088-134-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/5088-137-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/5088-138-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/5088-139-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/5088-140-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/5088-142-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/5088-143-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/5088-144-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads