22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe

General

Target

22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe
Size

116KB
MD5

a36aab25571dd22f6c0b47afecb574d0
SHA1

087cef4d565dece6a3fb17855ff50830324fbcaa
SHA256

22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe
SHA512

8cae4373cc4f59d2b9b1b292ae479d1925dd99cd3473ae2b67d81570c4e2c6da0f2075c385f5d73632b1138514d7f5cbfeccc47556505896383a1f6548b3179c
SSDEEP

1536:QMASiLNFZdO/rp0XU9CDYdjl6VJODU4a7lWCzLskh6DoIO2cWqIU:Q3vO/WXUMql6VJQa75Lxh6DS2O

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	aspack_v212_v242
behavioral1/files/0x00140000000054ab-62.dat	aspack_v212_v242
behavioral1/files/0x000800000001230c-65.dat	aspack_v212_v242
behavioral1/files/0x0009000000012304-72.dat	aspack_v212_v242
behavioral1/files/0x0009000000012304-73.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1496	375f3f90.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	375f3f90.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/memory/1496-60-0x00000000002A0000-0x00000000002C4000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-62.dat	upx
behavioral1/memory/1496-64-0x00000000002A0000-0x00000000002C4000-memory.dmp	upx
behavioral1/memory/1496-63-0x00000000002A0000-0x00000000002C4000-memory.dmp	upx
behavioral1/files/0x000800000001230c-65.dat	upx
behavioral1/files/0x0009000000012304-72.dat	upx
behavioral1/files/0x0009000000012304-73.dat	upx
behavioral1/memory/328-76-0x0000000074470000-0x0000000074494000-memory.dmp	upx
behavioral1/memory/328-75-0x0000000074470000-0x0000000074494000-memory.dmp	upx
behavioral1/memory/328-78-0x0000000074470000-0x0000000074494000-memory.dmp	upx
behavioral1/memory/1496-79-0x00000000002A0000-0x00000000002C4000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1496	375f3f90.exe
328	Svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\24CC04C8.tmp	375f3f90.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	375f3f90.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1496	375f3f90.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28
PID 1716 wrote to memory of 1496	1716	22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe	28

C:\Users\Admin\AppData\Local\Temp\22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe
"C:\Users\Admin\AppData\Local\Temp\22c8bf1ce8490ef4724370c1e9bb26c58c52491ea86b86b981e012f4084616fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\375f3f90.exe
  C:\375f3f90.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\375f3f90.exe

Filesize
81KB

MD5
ac78a01e3e58ade73798fe0b34a2c5b0

SHA1
b19cbe497eb67bd7c4b97b75dd68e871f3b6e428

SHA256
c6d627ef9b3620fbfebbd9177dceeaa895e7c60fb23a3d0ecf6f0682eaba3493

SHA512
24183ea1eb1a698acda90eae2aa169875b175db3367c6106d26a712743750f3f2e71226b64d63cb8be5d46a38db407b9300ef593ff19a414833913c2d5cb0fc2

Download Submit
C:\375f3f90.exe

Filesize
81KB

MD5
ac78a01e3e58ade73798fe0b34a2c5b0

SHA1
b19cbe497eb67bd7c4b97b75dd68e871f3b6e428

SHA256
c6d627ef9b3620fbfebbd9177dceeaa895e7c60fb23a3d0ecf6f0682eaba3493

SHA512
24183ea1eb1a698acda90eae2aa169875b175db3367c6106d26a712743750f3f2e71226b64d63cb8be5d46a38db407b9300ef593ff19a414833913c2d5cb0fc2

Download Submit
C:\Users\Infotmp.txt

Filesize
720B

MD5
ecd6c6dd62228a530eebba4c62a890e3

SHA1
873d8ed05e96f0c22f62c9ff7eff8903430ea020

SHA256
6cc8a5b4bcb471775c717f6322a49ca863abadf6002bbfcf97df284f573742aa

SHA512
02f619019f2893dcbf762dbf08284f24ffd08a9c737b761fc07a6dd11773676babc07febeb7762114d923432afbf98dd52ae3851226137d58fe41a1243bf8cdc

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
81KB

MD5
7dd3ce508080a47d0bd957e2a4f18256

SHA1
5df28bcf6ba5600388d6c8592a1dd002c3939b6b

SHA256
596d2522719c3df0e7278c933e94bcc113b5eff87e03d014dff12c78eb29308c

SHA512
9a41da473c65d8205a139160a2a46801d2e1bcfc1a78e731724652a98dcdd274d79d06d72249178884e20f0542d9387c50bb15d7771ed3f16c7fc0de6db693f6

Download Submit
\Windows\SysWOW64\24CC04C8.tmp

Filesize
81KB

MD5
7dd3ce508080a47d0bd957e2a4f18256

SHA1
5df28bcf6ba5600388d6c8592a1dd002c3939b6b

SHA256
596d2522719c3df0e7278c933e94bcc113b5eff87e03d014dff12c78eb29308c

SHA512
9a41da473c65d8205a139160a2a46801d2e1bcfc1a78e731724652a98dcdd274d79d06d72249178884e20f0542d9387c50bb15d7771ed3f16c7fc0de6db693f6

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
81KB

MD5
7dd3ce508080a47d0bd957e2a4f18256

SHA1
5df28bcf6ba5600388d6c8592a1dd002c3939b6b

SHA256
596d2522719c3df0e7278c933e94bcc113b5eff87e03d014dff12c78eb29308c

SHA512
9a41da473c65d8205a139160a2a46801d2e1bcfc1a78e731724652a98dcdd274d79d06d72249178884e20f0542d9387c50bb15d7771ed3f16c7fc0de6db693f6

Download Submit
memory/328-78-0x0000000074470000-0x0000000074494000-memory.dmp

Filesize
144KB

Download
memory/328-75-0x0000000074470000-0x0000000074494000-memory.dmp

Filesize
144KB

Download
memory/328-76-0x0000000074470000-0x0000000074494000-memory.dmp

Filesize
144KB

Download
memory/1496-67-0x0000000000130000-0x0000000000154000-memory.dmp

Filesize
144KB

Download
memory/1496-66-0x0000000000130000-0x0000000000154000-memory.dmp

Filesize
144KB

Download
memory/1496-81-0x0000000074CB0000-0x0000000074D10000-memory.dmp

Filesize
384KB

Download
memory/1496-68-0x0000000001F90000-0x0000000005F90000-memory.dmp

Filesize
64.0MB

Download
memory/1496-69-0x0000000074CB0000-0x0000000074D10000-memory.dmp

Filesize
384KB

Download
memory/1496-79-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1496-71-0x0000000001F90000-0x0000000005F90000-memory.dmp

Filesize
64.0MB

Download
memory/1496-64-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1496-80-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/1496-60-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1496-63-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1716-58-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/1716-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1716-59-0x0000000000210000-0x0000000000234000-memory.dmp

Filesize
144KB

Download
memory/1716-70-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/1716-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing