d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130

General

Target

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Size

960KB
MD5

aeb2334377ab2052e62053e306fcd6bc
SHA1

aadcab341f06c9ac060a7594ce7105542d229ce0
SHA256

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130
SHA512

d860869c339ae73cd67b9c7ddd6be7ad9e4a71dd7641dd75896cb1d166d912f6122994ce96181a2e910a66c36e726d294283d3dbbcd49abc40fcd77590fc936d
SSDEEP

24576:EbfyvfThf7vYQbjdD+yFVZxA7EwONaNGsbXQK:Ebfyjhj91h+7VOaNF

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1996-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-86-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1996-102-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1996-55-0x0000000000400000-0x0000000000684000-memory.dmp	vmprotect
behavioral1/memory/1996-107-0x0000000000400000-0x0000000000684000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

pid process

1996 d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com\NumberOfSubdomains = "1"	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "44"	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com\ = "44"	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com\Total = "44"	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com\NumberOfSubdomains = "2"	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

pid process

1996 d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

pid	process
1996	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
1996	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
1996	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
1996	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
1996	d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe

C:\Users\Admin\AppData\Local\Temp\d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe
"C:\Users\Admin\AppData\Local\Temp\d5ecbd2a293cf3ccc295f901b543c5951cfb9de19eff4e1e474effe702dda130.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1996-55-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/1996-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-72-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-76-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-74-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-80-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-86-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-88-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-90-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-92-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-94-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-82-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-102-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1996-103-0x00000000061C0000-0x00000000061D2000-memory.dmp

Filesize
72KB

Download
memory/1996-107-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads