f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997

General

Target

f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
Size

1.3MB
MD5

9d303a847f3244d07abbf111e497fd56
SHA1

839aa1697dcbd36ea16aa29310c88383a1256b30
SHA256

f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997
SHA512

ab1d3f9201ef2e45a3b408acd3436995cb650d33929ea9b8922c972eb07e17d5a2a203e6da898d4e9b137a9e6edbc4377d44dcd22f1a7919eac30efddabfcac0
SSDEEP

12288:dRcCgGHPjjplkGs5Y5o+ob6rP69Qw0mkjlbzonNSNXlFgw5Yu0ajPcR5nWFpPoSF:dSChZlN8Yq+oYPfwoEiFgeYuJbLRJ

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TongL\ImagePath = "\\??\\C:\\Program Files\\TongL.sys"	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1608-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1608-100-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1608	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\TongL.sys	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
File created	C:\Program Files\MDL_DLL.dll	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1608	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
1608	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
1608	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

C:\Users\Admin\AppData\Local\Temp\f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
"C:\Users\Admin\AppData\Local\Temp\f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\MDL_DLL.dll

Filesize
9KB

MD5
37bb0094ae381d9281507d70d2e045a5

SHA1
a15adb593556e789e232e135fa995a291688dbc5

SHA256
97a40856af013039f1508412f10d0fd67a6b314b598b7055c3e695f5983c1519

SHA512
ab135e4a081ab27a9ab4e413ffc92780825780a5795525cc5d9cde4652f2e317aa44638841c0a13b35e3a69df300437dbfd3ac340c6ecabe4c9690d8df8296d6

Download Submit
memory/1608-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1608-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1608-100-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing