abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf

Analysis

max time kernel
316s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe
Size

324KB
MD5

e39759cd8fc3632605a1d89bbe0e752e
SHA1

6ced5fb03b0fa20ecf98f44fa351e648a0f1977e
SHA256

abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf
SHA512

b0f2c956bc8f706637a902daa1c02f549f2d43e24182c507f06fd6919e38d2e942727126d9518e3e48ea6c7e90115ea9064ba7f4be12e922ec4428121fc24651
SSDEEP

6144:d/j5C+E13/4YIJ8m1MxUyRzoVOBlYQflIGE:d/s+qP4BJTM6++OBlYERE

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 13 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022de7-134.dat	aspack_v212_v242
behavioral2/files/0x0006000000022de7-135.dat	aspack_v212_v242
behavioral2/files/0x0006000000022def-140.dat	aspack_v212_v242
behavioral2/files/0x0006000000022def-141.dat	aspack_v212_v242
behavioral2/files/0x0006000000022df5-144.dat	aspack_v212_v242
behavioral2/files/0x0006000000022df9-146.dat	aspack_v212_v242
behavioral2/files/0x0006000000022df9-148.dat	aspack_v212_v242
behavioral2/files/0x0006000000022df5-147.dat	aspack_v212_v242
behavioral2/files/0x0006000000022dfa-155.dat	aspack_v212_v242
behavioral2/files/0x0006000000022dfa-157.dat	aspack_v212_v242
behavioral2/files/0x0006000000022dfc-161.dat	aspack_v212_v242
behavioral2/files/0x0006000000022dfc-162.dat	aspack_v212_v242
behavioral2/files/0x0006000000022dfe-166.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1456	1dde6cba.exe

Sets DLL path for service in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	1dde6cba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	1dde6cba.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-132-0x0000000020000000-0x0000000020053000-memory.dmp	upx
behavioral2/files/0x0006000000022de7-134.dat	upx
behavioral2/files/0x0006000000022de7-135.dat	upx
behavioral2/memory/1456-136-0x0000000000F00000-0x0000000000F4E000-memory.dmp	upx
behavioral2/memory/1456-137-0x0000000000F00000-0x0000000000F4E000-memory.dmp	upx
behavioral2/memory/1456-138-0x0000000000F00000-0x0000000000F4E000-memory.dmp	upx
behavioral2/files/0x0006000000022def-140.dat	upx
behavioral2/files/0x0006000000022def-141.dat	upx
behavioral2/memory/4804-143-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/4804-142-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022df5-144.dat	upx
behavioral2/memory/4804-145-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022df9-146.dat	upx
behavioral2/memory/4916-150-0x0000000075A70000-0x0000000075ABE000-memory.dmp	upx
behavioral2/memory/2472-149-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022df9-148.dat	upx
behavioral2/files/0x0006000000022df5-147.dat	upx
behavioral2/memory/4916-151-0x0000000075A70000-0x0000000075ABE000-memory.dmp	upx
behavioral2/memory/2472-152-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/4916-153-0x0000000075A70000-0x0000000075ABE000-memory.dmp	upx
behavioral2/memory/2472-154-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022dfa-155.dat	upx
behavioral2/files/0x0006000000022dfa-157.dat	upx
behavioral2/memory/2548-158-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/2548-159-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/2548-160-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022dfc-161.dat	upx
behavioral2/files/0x0006000000022dfc-162.dat	upx
behavioral2/memory/3004-163-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/3004-164-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/memory/3004-165-0x0000000075AC0000-0x0000000075B0E000-memory.dmp	upx
behavioral2/files/0x0006000000022dfe-166.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
4804	svchost.exe
2472	svchost.exe
4916	svchost.exe
2548	svchost.exe
3004	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ias.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	1dde6cba.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	1dde6cba.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	1dde6cba.exe
1456	1dde6cba.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1456	4228	abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe	84
PID 4228 wrote to memory of 1456	4228	abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe	84
PID 4228 wrote to memory of 1456	4228	abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe	84

C:\Users\Admin\AppData\Local\Temp\abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe
"C:\Users\Admin\AppData\Local\Temp\abbd647aed9c0d37aee8bfadb537b58d07f2755a24055cd19eb1aafda46ebfbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\1dde6cba.exe
  C:\1dde6cba.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4804

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
PID:2472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
PID:4916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
PID:2548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1dde6cba.exe

Filesize
240KB

MD5
f5d2a6e81cd9b23d4899371b296b8a8c

SHA1
7b095e73b522c5a1b12e26ae389464c5c123bc8e

SHA256
775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42

SHA512
77842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662

Download Submit
C:\1dde6cba.exe

Filesize
240KB

MD5
f5d2a6e81cd9b23d4899371b296b8a8c

SHA1
7b095e73b522c5a1b12e26ae389464c5c123bc8e

SHA256
775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42

SHA512
77842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
C:\Windows\SysWOW64\Irmon.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
C:\Windows\SysWOW64\NWCWorkstation.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
C:\Windows\SysWOW64\Nla.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
C:\Windows\SysWOW64\Ntmssvc.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\irmon.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\nla.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll

Filesize
240KB

MD5
e48f830a89ba95daf7650bb9b05bd117

SHA1
304e6666ad4a8e0329f7aa4646c34c5fe57d19fe

SHA256
046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6

SHA512
a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095

Download Submit
memory/1456-156-0x0000000002960000-0x0000000006960000-memory.dmp

Filesize
64.0MB

Download
memory/1456-136-0x0000000000F00000-0x0000000000F4E000-memory.dmp

Filesize
312KB

Download
memory/1456-138-0x0000000000F00000-0x0000000000F4E000-memory.dmp

Filesize
312KB

Download
memory/1456-137-0x0000000000F00000-0x0000000000F4E000-memory.dmp

Filesize
312KB

Download
memory/1456-139-0x0000000002960000-0x0000000006960000-memory.dmp

Filesize
64.0MB

Download
memory/2472-152-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/2472-154-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/2472-149-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/2548-160-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/2548-158-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/2548-159-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/3004-163-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/3004-164-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/3004-165-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/4228-132-0x0000000020000000-0x0000000020053000-memory.dmp

Filesize
332KB

Download
memory/4804-145-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/4804-143-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/4804-142-0x0000000075AC0000-0x0000000075B0E000-memory.dmp

Filesize
312KB

Download
memory/4916-153-0x0000000075A70000-0x0000000075ABE000-memory.dmp

Filesize
312KB

Download
memory/4916-151-0x0000000075A70000-0x0000000075ABE000-memory.dmp

Filesize
312KB

Download
memory/4916-150-0x0000000075A70000-0x0000000075ABE000-memory.dmp

Filesize
312KB

Download