f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997

General

Target

f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
Size

1.3MB
MD5

9d303a847f3244d07abbf111e497fd56
SHA1

839aa1697dcbd36ea16aa29310c88383a1256b30
SHA256

f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997
SHA512

ab1d3f9201ef2e45a3b408acd3436995cb650d33929ea9b8922c972eb07e17d5a2a203e6da898d4e9b137a9e6edbc4377d44dcd22f1a7919eac30efddabfcac0
SSDEEP

12288:dRcCgGHPjjplkGs5Y5o+ob6rP69Qw0mkjlbzonNSNXlFgw5Yu0ajPcR5nWFpPoSF:dSChZlN8Yq+oYPfwoEiFgeYuJbLRJ

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TongL\ImagePath = "\\??\\C:\\Program Files\\TongL.sys"	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4924-132-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-148-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4924-176-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4924	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\TongL.sys	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
File created	C:\Program Files\MDL_DLL.dll	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4924	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
4924	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
4924	f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe

C:\Users\Admin\AppData\Local\Temp\f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe
"C:\Users\Admin\AppData\Local\Temp\f864571eb20a983b7cc04f9e3a0c061be0a51f00e74aef632b233bd87f201997.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MDL_DLL.dll

Filesize
9KB

MD5
37bb0094ae381d9281507d70d2e045a5

SHA1
a15adb593556e789e232e135fa995a291688dbc5

SHA256
97a40856af013039f1508412f10d0fd67a6b314b598b7055c3e695f5983c1519

SHA512
ab135e4a081ab27a9ab4e413ffc92780825780a5795525cc5d9cde4652f2e317aa44638841c0a13b35e3a69df300437dbfd3ac340c6ecabe4c9690d8df8296d6

Download Submit
memory/4924-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-132-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-148-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4924-176-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing