5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3

General

Target

5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe
Size

256KB
MD5

0c071a67c99e505b573db30387c2ace7
SHA1

353e0312e7c7b28910e5a00740cf26498b15453b
SHA256

5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3
SHA512

c7df245acc8cb143609c8c6f3e5283d58f59bd3b00fab84c42a2e8672334f46f7a6ec7a3d2303f85175a6a8ecd75aa107f257b0d0c6b772be8445736b8c559f3
SSDEEP

6144:bvvuchulnYvSOEt5zpaiRhcuGE07v6a8:bXU+wNxRhTKj6

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00140000000054ab-58.dat	aspack_v212_v242
behavioral1/files/0x00140000000054ab-56.dat	aspack_v212_v242
behavioral1/files/0x00090000000122ee-61.dat	aspack_v212_v242
behavioral1/files/0x00080000000122ef-71.dat	aspack_v212_v242
behavioral1/files/0x00080000000122ef-70.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1256	292e5526.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	292e5526.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/memory/1256-60-0x0000000000280000-0x00000000002C8000-memory.dmp	upx
behavioral1/memory/1256-59-0x0000000000280000-0x00000000002C8000-memory.dmp	upx
behavioral1/files/0x00090000000122ee-61.dat	upx
behavioral1/memory/1256-65-0x0000000000280000-0x00000000002C8000-memory.dmp	upx
behavioral1/files/0x00080000000122ef-71.dat	upx
behavioral1/memory/1500-76-0x0000000074AC0000-0x0000000074B08000-memory.dmp	upx
behavioral1/memory/1500-74-0x0000000074AC0000-0x0000000074B08000-memory.dmp	upx
behavioral1/memory/1500-73-0x0000000074AC0000-0x0000000074B08000-memory.dmp	upx
behavioral1/files/0x00080000000122ef-70.dat	upx

Loads dropped DLL 2 IoCs

pid	Process
1256	292e5526.exe
1500	Svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\3D5904B4.tmp	292e5526.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	292e5526.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1256	292e5526.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16
PID 1932 wrote to memory of 1256	1932	5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe	16

C:\292e5526.exe
C:\292e5526.exe
1⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Users\Admin\AppData\Local\Temp\5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe
"C:\Users\Admin\AppData\Local\Temp\5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\292e5526.exe

Filesize
223KB

MD5
d31be269eff784b082fc8816b4847499

SHA1
0b8c8f99352dddb2548486cc3c6eb5a068bfad3b

SHA256
9e5b6218c75a22c897687c7872f1b35825411e3a4e05e56650966e8999014047

SHA512
e847065b7405588c364e004a993b80d0a5cca763393a49535869bc910623134c4d96eb0d9dad85b24b9da6f1fbea0d246cf7feec5b1433ed2c130e4f7252b3af

Download Submit
C:\292e5526.exe

Filesize
223KB

MD5
d31be269eff784b082fc8816b4847499

SHA1
0b8c8f99352dddb2548486cc3c6eb5a068bfad3b

SHA256
9e5b6218c75a22c897687c7872f1b35825411e3a4e05e56650966e8999014047

SHA512
e847065b7405588c364e004a993b80d0a5cca763393a49535869bc910623134c4d96eb0d9dad85b24b9da6f1fbea0d246cf7feec5b1433ed2c130e4f7252b3af

Download Submit
C:\Users\Infotmp.txt

Filesize
724B

MD5
1907d9b4d9a3f9b78cb1d1bcdadf62b2

SHA1
6649a9e3a82637ba2b1a5f1bf313af18066c5cfe

SHA256
f2ebaa478b5cb03d8fb21972d35f96ae36c391960dd792e8b0ddca694234ffef

SHA512
bad443e87c49cda68c4d0b8c0da8130584574bb54f012538ebad7f564497092c3d1ca87feebe27a963497a2badf2cc629cbf757dd1383b8fc27d7de98a0fa698

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
223KB

MD5
d8c4b2d029ca0e6c77f248a11cba01da

SHA1
35c35b7e1c4e34328212dccf83aaee87cb36d050

SHA256
d8e7ac66844762b17c7d57e663b4b9044347ede197f2492e90f4b6d0d3f19c37

SHA512
0266c507c64a2c7603bf7897eab543cac6aae6fc028d1fb29afac6ac3f27697f21612680b888a4c97837c8272d30fb8c3cccef89826648eaf9bd38cd956f3285

Download Submit
\Windows\SysWOW64\3D5904B4.tmp

Filesize
223KB

MD5
d8c4b2d029ca0e6c77f248a11cba01da

SHA1
35c35b7e1c4e34328212dccf83aaee87cb36d050

SHA256
d8e7ac66844762b17c7d57e663b4b9044347ede197f2492e90f4b6d0d3f19c37

SHA512
0266c507c64a2c7603bf7897eab543cac6aae6fc028d1fb29afac6ac3f27697f21612680b888a4c97837c8272d30fb8c3cccef89826648eaf9bd38cd956f3285

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
223KB

MD5
d8c4b2d029ca0e6c77f248a11cba01da

SHA1
35c35b7e1c4e34328212dccf83aaee87cb36d050

SHA256
d8e7ac66844762b17c7d57e663b4b9044347ede197f2492e90f4b6d0d3f19c37

SHA512
0266c507c64a2c7603bf7897eab543cac6aae6fc028d1fb29afac6ac3f27697f21612680b888a4c97837c8272d30fb8c3cccef89826648eaf9bd38cd956f3285

Download Submit
memory/1256-59-0x0000000000280000-0x00000000002C8000-memory.dmp

Filesize
288KB

Download
memory/1256-65-0x0000000000280000-0x00000000002C8000-memory.dmp

Filesize
288KB

Download
memory/1256-66-0x00000000002D0000-0x0000000000318000-memory.dmp

Filesize
288KB

Download
memory/1256-67-0x0000000002100000-0x0000000006100000-memory.dmp

Filesize
64.0MB

Download
memory/1256-69-0x0000000074AC0000-0x0000000074B08000-memory.dmp

Filesize
288KB

Download
memory/1256-68-0x0000000077420000-0x0000000077480000-memory.dmp

Filesize
384KB

Download
memory/1256-78-0x0000000077420000-0x0000000077480000-memory.dmp

Filesize
384KB

Download
memory/1256-60-0x0000000000280000-0x00000000002C8000-memory.dmp

Filesize
288KB

Download
memory/1500-76-0x0000000074AC0000-0x0000000074B08000-memory.dmp

Filesize
288KB

Download
memory/1500-73-0x0000000074AC0000-0x0000000074B08000-memory.dmp

Filesize
288KB

Download
memory/1500-74-0x0000000074AC0000-0x0000000074B08000-memory.dmp

Filesize
288KB

Download
memory/1932-62-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1932-77-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/1932-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1932-63-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download
memory/1932-64-0x0000000000180000-0x00000000001C8000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing