058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5

General

Target

058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe
Size

168KB
MD5

a0702a1fc564d8058ec72ede6ac221d0
SHA1

2a3dfd21838c89148ec50bf9d050322e90c32513
SHA256

058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5
SHA512

3637783774290a9bbc0a16259b5cd15fe2a7bc055f739ab66efec43407da264f01191f3af3b88bdc74dcda2f8ba28a32c7434c7ce21bae54b8e57972ca8378db
SSDEEP

3072:eqPL1/7w6ZAs+VBK54Yha+LwjWlVvgir23ejaAVkuXYJnnL:rQV84Yw+eWl97aOHXYJn

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	aspack_v212_v242
behavioral1/files/0x00080000000134d5-60.dat	aspack_v212_v242
behavioral1/files/0x000c0000000054a8-59.dat	aspack_v212_v242
behavioral1/files/0x00090000000133d3-68.dat	aspack_v212_v242
behavioral1/files/0x00090000000133d3-67.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1728	1ac600cd.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	1ac600cd.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	upx
behavioral1/memory/1728-57-0x0000000000ED0000-0x0000000000EF6000-memory.dmp	upx
behavioral1/memory/1728-58-0x0000000000ED0000-0x0000000000EF6000-memory.dmp	upx
behavioral1/files/0x00080000000134d5-60.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/memory/1728-63-0x0000000000ED0000-0x0000000000EF6000-memory.dmp	upx
behavioral1/memory/1728-65-0x0000000075CF0000-0x0000000075D50000-memory.dmp	upx
behavioral1/files/0x00090000000133d3-68.dat	upx
behavioral1/files/0x00090000000133d3-67.dat	upx
behavioral1/memory/1184-71-0x0000000075290000-0x00000000752B6000-memory.dmp	upx
behavioral1/memory/1184-70-0x0000000075290000-0x00000000752B6000-memory.dmp	upx
behavioral1/memory/1184-73-0x0000000075290000-0x00000000752B6000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1728	1ac600cd.exe
1184	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	1ac600cd.exe
File opened for modification	C:\Windows\SysWOW64\5CFC0568.tmp	1ac600cd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	1ac600cd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1728	912	058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe	27
PID 912 wrote to memory of 1728	912	058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe	27
PID 912 wrote to memory of 1728	912	058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe	27
PID 912 wrote to memory of 1728	912	058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe	27

C:\Users\Admin\AppData\Local\Temp\058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe
"C:\Users\Admin\AppData\Local\Temp\058e3703e776a869b369ace200a573b99ab9802c919f5658fb18fe582a0f6ad5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\1ac600cd.exe
  C:\1ac600cd.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1ac600cd.exe

Filesize
90KB

MD5
f0972ebc948cc238c3db9cd9eb80e8ce

SHA1
d1802811a9668b647f2dfbe085f236883a8ada19

SHA256
5eff8bbe09c3e3f541074059ba2fb7668f22ffed13ba5457852f79c8bffa76d4

SHA512
5ae72af9b952cc35d019825e4cdc6dcb6b2ef7c411b1b4fc0a68e00eaf851dfffdd66ed88c8d87d4b066eb3a4c8832e36e3455094c82ce2f3c82b80952108230

Download Submit
C:\1ac600cd.exe

Filesize
90KB

MD5
f0972ebc948cc238c3db9cd9eb80e8ce

SHA1
d1802811a9668b647f2dfbe085f236883a8ada19

SHA256
5eff8bbe09c3e3f541074059ba2fb7668f22ffed13ba5457852f79c8bffa76d4

SHA512
5ae72af9b952cc35d019825e4cdc6dcb6b2ef7c411b1b4fc0a68e00eaf851dfffdd66ed88c8d87d4b066eb3a4c8832e36e3455094c82ce2f3c82b80952108230

Download Submit
C:\Users\Infotmp.txt

Filesize
720B

MD5
4bbe3d4422d8917cdd9a4791ef0ee712

SHA1
e414a87dce4d51f4cf8692b2fc55c84154fc46d5

SHA256
e57e3459142cf2b447055b82fe34f0415016eed86f0cf87ab1143a0cbf1b0abf

SHA512
a727861f723a33689d62023fa69ad07fbbb238e2a7bf2749b028c6609104a736af31275414b29d2f1bf946d710ae89ed884ffaba6818d38ef459a311b05dd1d0

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
90KB

MD5
6a68bc6aa5b0622cf5906db10a558f8a

SHA1
c4d97b5a6b0a6590a81cfeab677b5ede5c9e79e1

SHA256
b868c72adaa0edb2e06f631ce9f46376a9d9dfa562caed140c58f0de5fb557ca

SHA512
cd45bb49547a66eca309c617d08b047ff1bbae4585f5ef63cc58853e1c14c288b1c5084bcac4327a8e101b92a456fbf8bad68e433a911e3bdb6f0bc1651f1acf

Download Submit
\Windows\SysWOW64\5CFC0568.tmp

Filesize
90KB

MD5
6a68bc6aa5b0622cf5906db10a558f8a

SHA1
c4d97b5a6b0a6590a81cfeab677b5ede5c9e79e1

SHA256
b868c72adaa0edb2e06f631ce9f46376a9d9dfa562caed140c58f0de5fb557ca

SHA512
cd45bb49547a66eca309c617d08b047ff1bbae4585f5ef63cc58853e1c14c288b1c5084bcac4327a8e101b92a456fbf8bad68e433a911e3bdb6f0bc1651f1acf

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
90KB

MD5
6a68bc6aa5b0622cf5906db10a558f8a

SHA1
c4d97b5a6b0a6590a81cfeab677b5ede5c9e79e1

SHA256
b868c72adaa0edb2e06f631ce9f46376a9d9dfa562caed140c58f0de5fb557ca

SHA512
cd45bb49547a66eca309c617d08b047ff1bbae4585f5ef63cc58853e1c14c288b1c5084bcac4327a8e101b92a456fbf8bad68e433a911e3bdb6f0bc1651f1acf

Download Submit
memory/912-74-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/912-61-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/912-62-0x0000000000160000-0x0000000000186000-memory.dmp

Filesize
152KB

Download
memory/912-75-0x0000000000160000-0x0000000000186000-memory.dmp

Filesize
152KB

Download
memory/1184-70-0x0000000075290000-0x00000000752B6000-memory.dmp

Filesize
152KB

Download
memory/1184-71-0x0000000075290000-0x00000000752B6000-memory.dmp

Filesize
152KB

Download
memory/1184-73-0x0000000075290000-0x00000000752B6000-memory.dmp

Filesize
152KB

Download
memory/1728-65-0x0000000075CF0000-0x0000000075D50000-memory.dmp

Filesize
384KB

Download
memory/1728-66-0x0000000075290000-0x00000000752B6000-memory.dmp

Filesize
152KB

Download
memory/1728-64-0x0000000002300000-0x0000000006300000-memory.dmp

Filesize
64.0MB

Download
memory/1728-57-0x0000000000ED0000-0x0000000000EF6000-memory.dmp

Filesize
152KB

Download
memory/1728-56-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1728-54-0x0000000000000000-mapping.dmp

Download
memory/1728-63-0x0000000000ED0000-0x0000000000EF6000-memory.dmp

Filesize
152KB

Download
memory/1728-58-0x0000000000ED0000-0x0000000000EF6000-memory.dmp

Filesize
152KB

Download
memory/1728-76-0x0000000075CF0000-0x0000000075D50000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing