d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878

General

Target

d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
Size

183KB
MD5

2151c09c1db2a9a08ca36b2c77c84630
SHA1

e104bb0bf94d0b48c2d9751ed6e1cac442e5b46c
SHA256

d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878
SHA512

fb59dd97098d932ead43bd8783ecbfb6ef04c54c94035d41a502e3636009a3bab106d72e0b8f5425f2bfad9ccd02a78d6e77b2f367b43a8559e30b4c376d9159
SSDEEP

3072:WhZMMCvQj0eTvmQM3gu+lJw+uL8mhbqIXE/iOMHg2c8uXsAV:kZmUXTvmQgguDLOixHg2c8iV

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b0000000122f6-55.dat	aspack_v212_v242
behavioral1/files/0x0009000000012311-60.dat	aspack_v212_v242
behavioral1/files/0x000b0000000122f6-59.dat	aspack_v212_v242
behavioral1/files/0x000900000001230a-66.dat	aspack_v212_v242
behavioral1/files/0x000900000001230a-67.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1952	16b04c30.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	16b04c30.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122f6-55.dat	upx
behavioral1/memory/1952-58-0x0000000000F20000-0x0000000000F44000-memory.dmp	upx
behavioral1/memory/1952-57-0x0000000000F20000-0x0000000000F44000-memory.dmp	upx
behavioral1/files/0x0009000000012311-60.dat	upx
behavioral1/files/0x000b0000000122f6-59.dat	upx
behavioral1/memory/1952-63-0x0000000000F20000-0x0000000000F44000-memory.dmp	upx
behavioral1/files/0x000900000001230a-66.dat	upx
behavioral1/files/0x000900000001230a-67.dat	upx
behavioral1/memory/1768-69-0x00000000744B0000-0x00000000744D4000-memory.dmp	upx
behavioral1/memory/1768-70-0x00000000744B0000-0x00000000744D4000-memory.dmp	upx
behavioral1/memory/1768-72-0x00000000744B0000-0x00000000744D4000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1952	16b04c30.exe
1768	Svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\0EFD04C4.tmp	16b04c30.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	16b04c30.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	16b04c30.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1952	1976	d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe	28
PID 1976 wrote to memory of 1952	1976	d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe	28
PID 1976 wrote to memory of 1952	1976	d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe	28
PID 1976 wrote to memory of 1952	1976	d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe	28

C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
"C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\16b04c30.exe
  C:\16b04c30.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\16b04c30.exe

Filesize
143KB

MD5
d4b4d82ddb32ea8de49571df94b08e14

SHA1
7f0702725855422e5ded1dd247522ccb982b162e

SHA256
f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340

SHA512
cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256

Download Submit
C:\16b04c30.exe

Filesize
143KB

MD5
d4b4d82ddb32ea8de49571df94b08e14

SHA1
7f0702725855422e5ded1dd247522ccb982b162e

SHA256
f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340

SHA512
cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256

Download Submit
C:\Users\Infotmp.txt

Filesize
720B

MD5
da03aa0be64504edb0884ce0eae258d7

SHA1
e100d24f88a0ae9f85562996b612c1024e9fc610

SHA256
0dad20c35559e58b0a559abbc3a3acecd916d4304aef07f73b32be78f11769dd

SHA512
530d4c496d5514f213cb6bb2f3df4370348617582f05c35fc8d2f42761baa1b4e21dabd6df57b462b68b86280859270c07c8d271bafc0024f49e6d10b4320ada

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
143KB

MD5
ab5db2af8f8e8f5ce0defc51d21e8963

SHA1
577e8eb5d7f97eed02a18704b30dfff7eac1260a

SHA256
4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

SHA512
e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

Download Submit
\Windows\SysWOW64\0EFD04C4.tmp

Filesize
143KB

MD5
ab5db2af8f8e8f5ce0defc51d21e8963

SHA1
577e8eb5d7f97eed02a18704b30dfff7eac1260a

SHA256
4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

SHA512
e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
143KB

MD5
ab5db2af8f8e8f5ce0defc51d21e8963

SHA1
577e8eb5d7f97eed02a18704b30dfff7eac1260a

SHA256
4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

SHA512
e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

Download Submit
memory/1768-72-0x00000000744B0000-0x00000000744D4000-memory.dmp

Filesize
144KB

Download
memory/1768-70-0x00000000744B0000-0x00000000744D4000-memory.dmp

Filesize
144KB

Download
memory/1768-69-0x00000000744B0000-0x00000000744D4000-memory.dmp

Filesize
144KB

Download
memory/1952-57-0x0000000000F20000-0x0000000000F44000-memory.dmp

Filesize
144KB

Download
memory/1952-64-0x0000000002350000-0x0000000006350000-memory.dmp

Filesize
64.0MB

Download
memory/1952-65-0x0000000074CA0000-0x0000000074D00000-memory.dmp

Filesize
384KB

Download
memory/1952-63-0x0000000000F20000-0x0000000000F44000-memory.dmp

Filesize
144KB

Download
memory/1952-58-0x0000000000F20000-0x0000000000F44000-memory.dmp

Filesize
144KB

Download
memory/1952-73-0x0000000074CA0000-0x0000000074D00000-memory.dmp

Filesize
384KB

Download
memory/1952-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1976-62-0x0000000000F20000-0x0000000000F44000-memory.dmp

Filesize
144KB

Download
memory/1976-61-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing