7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f

General

Target

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Size

384KB
MD5

9d37c2d88562bf9520bbc8186c28dddd
SHA1

3cb57cbab6a3ca96cda1188d09a8f084c8ab3b78
SHA256

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f
SHA512

bee4f83b1b1e284065f1a7dd08309007cfeef05e3319d6cc0d22259d51be919bbf82a99b83171cbf9af62ce94c53236f20510d9baef551969718e62213fec98e
SSDEEP

6144:W6YkTLi7oZ83Rl/M01nQgDB3rd3GVhwRlMJjORq5vuaYm/DFDs:kkHi7oC3R+01n3DGaTsjG6DBs

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid process

240 7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid	process
240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exeExplorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\EukeqUdtol = "regsvr32.exe \"C:\\ProgramData\\EukeqUdtol\\EukeqUdtol.dat\""	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\EukeqUdtol = "regsvr32.exe \"C:\\ProgramData\\EukeqUdtol\\EukeqUdtol.dat\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 6 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{73DB1225-6F46-4AD8-8E71-53305F0C4310}	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{73DB1225-6F46-4AD8-8E71-53305F0C4310}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c376336353032383064306161393832386665623831663837633831316664356638653533613834633631316161623539393032623736326564376430396430662e65786500	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{73DB1225-6F46-4AD8-8E71-53305F0C4310}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75C12FCE-40B8-49B6-90BA-562935202E52}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75C12FCE-40B8-49B6-90BA-562935202E52}\{14A76F5B-6BDA-4F7C-9C68-449F7BC250EB} = 6183c8a8	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{73DB1225-6F46-4AD8-8E71-53305F0C4310}\#cert = 31	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exewmiprvse.exe

pid process

240 7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
1940 wmiprvse.exe
1940 wmiprvse.exe

pid	process
240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
1940	wmiprvse.exe
1940	wmiprvse.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exeExplorer.EXE

description	pid	process
Token: SeCreateGlobalPrivilege	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Token: SeDebugPrivilege	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Token: SeCreateGlobalPrivilege	1432	Explorer.EXE
Token: SeShutdownPrivilege	1432	Explorer.EXE
Token: SeDebugPrivilege	1432	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid process

240 7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid	process
240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

description	pid	process	target process
PID 240 wrote to memory of 456	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	spoolsv.exe
PID 240 wrote to memory of 456	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	spoolsv.exe
PID 240 wrote to memory of 1432	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	Explorer.EXE
PID 240 wrote to memory of 1432	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	Explorer.EXE
PID 240 wrote to memory of 1216	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	sppsvc.exe
PID 240 wrote to memory of 1216	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	sppsvc.exe
PID 240 wrote to memory of 2028	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	WMIADAP.EXE
PID 240 wrote to memory of 2028	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	WMIADAP.EXE
PID 240 wrote to memory of 1940	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	wmiprvse.exe
PID 240 wrote to memory of 1940	240	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe	wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2028

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1216

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Users\Admin\AppData\Local\Temp\7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
"C:\Users\Admin\AppData\Local\Temp\7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:456

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\EukeqUdtol\EukeqUdtol.dat
Filesize
288KB

MD5
9f7172eb65fc3f7e5b32578a3b3693c4

SHA1
d40340b67adbfbf0c1038aefac6ae72400fff365

SHA256
0a59adf6d1f6c1ac7d0a164812dee28aad434055d9acb3a9953341263de572da

SHA512
cf1f3b7091ad0856e711ac84afec3b4aaee2823f3cbde679ad8d19bb5591c0bcaec9d72c38de7cf4c81a3e65d9ea0aa0cb5aee8a4e4e03ad5e1774bf68c63d8f

Download Submit
\ProgramData\EukeqUdtol\EukeqUdtol.dat
Filesize
288KB

MD5
9f7172eb65fc3f7e5b32578a3b3693c4

SHA1
d40340b67adbfbf0c1038aefac6ae72400fff365

SHA256
0a59adf6d1f6c1ac7d0a164812dee28aad434055d9acb3a9953341263de572da

SHA512
cf1f3b7091ad0856e711ac84afec3b4aaee2823f3cbde679ad8d19bb5591c0bcaec9d72c38de7cf4c81a3e65d9ea0aa0cb5aee8a4e4e03ad5e1774bf68c63d8f

Download Submit
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/240-55-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/240-58-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/240-59-0x0000000074810000-0x0000000074843000-memory.dmp

Filesize
204KB

Download
memory/240-74-0x0000000074810000-0x000000007487E000-memory.dmp

Filesize
440KB

Download
memory/240-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/240-78-0x0000000074810000-0x0000000074843000-memory.dmp

Filesize
204KB

Download
memory/456-61-0x0000000001BF0000-0x0000000001C44000-memory.dmp

Filesize
336KB

Download
memory/1432-75-0x0000000002AB0000-0x0000000002B04000-memory.dmp

Filesize
336KB

Download
memory/1432-76-0x0000000003F20000-0x0000000003F8B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads