59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1

General

Target

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
Size

724KB
MD5

b2f073dfef7228c39c6616828bfecc96
SHA1

43b4a0025e4fadbc14889f195c6dde13d497cb2c
SHA256

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1
SHA512

eddb98c9ffec2163ecf4521f209aabee742d419a22e8ec8af502d5f64ecba215632960528d556597ea6a5bf5c207fb41e4d716d58927f6da994cc78d4704c17a
SSDEEP

12288:OT5864aY0sHGff7WE86sfaCtwlL0PCfR8+tiOtN/4PYY/UxtiT5K5gibV5f6U5Xk:OTwgk8SE86siCtwlL0PCp8yiOtN/AvUt

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1152-136-0x00000000025E0000-0x0000000002652000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/1152-132-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral2/memory/1152-133-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral2/memory/1152-147-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3012	taskkill.exe
2212	taskkill.exe
2408	taskkill.exe
2656	taskkill.exe
3232	taskkill.exe
1828	taskkill.exe
1936	taskkill.exe
3560	taskkill.exe
3964	taskkill.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?ktt659189"	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

pid	process
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	3964	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

pid	process
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe

description	pid	process	target process
PID 1152 wrote to memory of 3964	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3964	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3964	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2212	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2212	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2212	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2408	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2408	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2408	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2656	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2656	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 2656	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3012	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3012	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3012	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3232	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3232	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3232	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1828	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1828	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1828	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1936	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1936	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 1936	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3560	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3560	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe
PID 1152 wrote to memory of 3560	1152	59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe
"C:\Users\Admin\AppData\Local\Temp\59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TXPlatform.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im DNFchina.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-133-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1152-136-0x00000000025E0000-0x0000000002652000-memory.dmp

Filesize
456KB

Download
memory/1152-148-0x00000000025E0000-0x0000000002652000-memory.dmp

Filesize
456KB

Download
memory/1152-132-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1152-147-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1152-146-0x00000000025E0000-0x0000000002652000-memory.dmp

Filesize
456KB

Download
memory/1828-143-0x0000000000000000-mapping.dmp

Download
memory/1936-144-0x0000000000000000-mapping.dmp

Download
memory/2212-138-0x0000000000000000-mapping.dmp

Download
memory/2408-139-0x0000000000000000-mapping.dmp

Download
memory/2656-140-0x0000000000000000-mapping.dmp

Download
memory/3012-141-0x0000000000000000-mapping.dmp

Download
memory/3232-142-0x0000000000000000-mapping.dmp

Download
memory/3560-145-0x0000000000000000-mapping.dmp

Download
memory/3964-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads