e6ae909e87b7c9548c22c7231d1f5a62f11ae21c62057ca2972fa5a2382dbfc1

General

Target

e6ae909e87b7c9548c22c7231d1f5a62f11ae21c62057ca2972fa5a2382dbfc1.dll
Size

862KB
MD5

8a5abaa245a3e8fed32689f1daaf0185
SHA1

57417c64b6ff8610c1b2b4d263d46df15a3666f1
SHA256

e6ae909e87b7c9548c22c7231d1f5a62f11ae21c62057ca2972fa5a2382dbfc1
SHA512

51877433b7d96a43b77d5d313364876ab75f26613c41597f84eab64c98ca887f10a58c8c5f7df2a6c721b5fde699aa83aaab70311d55e1abe7aba7ca71c57cdd
SSDEEP

12288:6gDIklTu75YtgDCVB9pR3idO970Ok/7DvALQjhzDLdv3/C2vWBuyDkbA:pDIN7Ot+CVBzRydm0OcbA8hLdv+BuG5

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	rundll32.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/956-56-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-57-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-58-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-59-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-60-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-62-0x0000000002010000-0x0000000002250000-memory.dmp	themida
behavioral1/memory/956-63-0x0000000002010000-0x0000000002250000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

956 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
956	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B36AB301-6EF3-11ED-BAA3-DE6E3020A1A7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002f43a56217b81c36dbc076b18ce163afaf1798e1c81732d5428d6a4a38f64ee0000000000e800000000200002000000003be39a932d74f0fcbcc659922a370b602ecad9b8f62948236a3fc78aceccb2890000000d3b221d7cf139512b78b33d78670ce499a7d6f4e49a80ba637f4d5f3e4aad019690abb018e0abe0ee3c432d0fc680a2dc7371e23acfd6e67049b13e58f987565b9f818b2f025100776b6ff94b3c3bb935f2c880a0df912d059184f8702e18da1c36e08466a2186c68a6fc7277b0eede9a55a4b8b6f491fe090cb7eee4238493242fcc607078507560a7ed724ab711b4240000000291ca4a1d046e691ccfbc8acc6caa2ec8007363dc15f8a7502d6ddd8a9d3f8431b0b44cf0827cf47cc216bc82d6ac0b533e3aa33ccb337c88681c9cf54a933bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376387823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9007618d0003d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003e5802007f7ef53669058ead8e3dfbd7d8714a2516ebfd38c1f3d7657c5f886e000000000e8000000002000020000000d509878815b235b0ffe8bc2ee6bd635f29ebf821776722da76ed1eef5ac1e18720000000ba066ca53ff145df0815e68420560343f3c3235565d54016b46e9bbb7b6b7b6d40000000a79631d4658872985500f55187f96cd0f177d41d2ecaf9bb5169efb8b7361ad156e687b39b09d985b0da353fef79fad025506425b7b87bccc913afe04cfa0cbd	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

956 rundll32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1780 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1780 iexplore.exe
1780 iexplore.exe
1692 IEXPLORE.EXE
1692 IEXPLORE.EXE
1692 IEXPLORE.EXE
1692 IEXPLORE.EXE

pid	process
956	rundll32.exe

pid	process
1780	iexplore.exe

pid	process
1780	iexplore.exe
1780	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exeiexplore.exe

description	pid	process	target process
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1780	956	rundll32.exe	iexplore.exe
PID 956 wrote to memory of 1780	956	rundll32.exe	iexplore.exe
PID 956 wrote to memory of 1780	956	rundll32.exe	iexplore.exe
PID 956 wrote to memory of 1780	956	rundll32.exe	iexplore.exe
PID 1780 wrote to memory of 1692	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1692	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1692	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1692	1780	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ae909e87b7c9548c22c7231d1f5a62f11ae21c62057ca2972fa5a2382dbfc1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ae909e87b7c9548c22c7231d1f5a62f11ae21c62057ca2972fa5a2382dbfc1.dll,#1
2⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/user/MRs0beit
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c6129b483428c62619699e960bcb7d29

SHA1
e79d2a4197f190f9458cfccec2b6cfb55b0b785c

SHA256
1f701443225aaf3b0f549002beead42ec378e60788c6a2be634a7d557c982ca0

SHA512
012b06c285396025fd81084f8ea8dcf9b1b1200294c409dd85ce445c3ad22902d0d61a4289d91de444d4b2612fa76d6d4e9640ef0ef7cf2ec99f47f2eb515e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
9KB

MD5
5528c952aeea097b2ca154a6415953e1

SHA1
353a6848577fda33dbfeca6364b4c7cbff7f0bd4

SHA256
636969b5622d684a35f5abf6f1a5d9c4a2e3951f51714648e885e0be56465c29

SHA512
5e077216216ed095448554e45dcb7f9ee73a576ea932cda12518413ffc80ff6fa57bff22cabe9f518dec88568697be26a063b209d45a0fba0f6709997cdf420b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\831PK8WR.txt
Filesize
603B

MD5
e3bbb27ec26600abacab612ff440052b

SHA1
3df3184b4b50f4a6efe7fd44be92d75476610c06

SHA256
5b1a594a261c53c4c97a754fe0515534b9012e98b4e3e2b114cdcaa696c0133e

SHA512
1638ce95d85be80fe943d76031818027cec350d349f40f1cd0e523ae3e017972ce60c87838f20337c91e7446b02c43b02d87b8d81f0ed5acec37ac7e4bf66167

Download Submit
memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-57-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-58-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-59-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-60-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-62-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download
memory/956-63-0x0000000002010000-0x0000000002250000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads