a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2

General

Target

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
Size

361KB
MD5

11237374706a36f4f556e6afa6feec71
SHA1

689f06cf6772a9bb6ea5eeb4764bf962f81a6080
SHA256

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2
SHA512

3084502dcc04451ee51ed820318cbed89f96f3c5bb6abcbddb4bb6526f913e61b5fee1ed7636ad12d16e17ee41d954516e2c18859afac39789ff441debaa9886
SSDEEP

6144:EttBiR4jOsq9aEsiUscu5H2wXXDdGMzWdvV0ZkrrC7/Z8p4xpfgMS8GXelP:E04WoEsiUo5H2OXoMzwvV0GraGCp4Mu

Score

9^/10

collection discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\msilar32.dll	acprotect
\Windows\SysWOW64\msilar32.dll	acprotect
\Windows\SysWOW64\msilar32.dll	acprotect
\Windows\SysWOW64\msilar32.dll	acprotect
\Windows\SysWOW64\msilar32.dll	acprotect

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/536-55-0x0000000000400000-0x000000000046B000-memory.dmp	upx
C:\Windows\SysWOW64\msilar32.dll	upx
\Windows\SysWOW64\msilar32.dll	upx
\Windows\SysWOW64\msilar32.dll	upx
\Windows\SysWOW64\msilar32.dll	upx
\Windows\SysWOW64\msilar32.dll	upx
behavioral1/memory/1956-67-0x0000000010000000-0x0000000010086000-memory.dmp	upx
behavioral1/memory/536-68-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1956 rundll32.exe
1956 rundll32.exe
1956 rundll32.exe
1956 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1956	rundll32.exe
1956	rundll32.exe
1956	rundll32.exe
1956	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msilar32.dll,rbNCrnSwdubl"	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msilar32.dll	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
File opened for modification	C:\Windows\SysWOW64\msilar32.dll	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1456 536 WerFault.exe a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

pid	pid_target	process	target process
1456	536	WerFault.exe	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

pid	process
536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	pid	process	target process
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1956	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 536 wrote to memory of 1456	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	WerFault.exe
PID 536 wrote to memory of 1456	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	WerFault.exe
PID 536 wrote to memory of 1456	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	WerFault.exe
PID 536 wrote to memory of 1456	536	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	WerFault.exe

outlook_win_path 1 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

C:\Users\Admin\AppData\Local\Temp\a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
"C:\Users\Admin\AppData\Local\Temp\a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:536

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe msilar32.dll,rbNCrnSwdubl
2⤵
- Loads dropped DLL
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 340
2⤵
- Program crash
PID:1456

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msilar32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
\Windows\SysWOW64\msilar32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
\Windows\SysWOW64\msilar32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
\Windows\SysWOW64\msilar32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
\Windows\SysWOW64\msilar32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
memory/536-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/536-57-0x0000000001DB0000-0x0000000001E36000-memory.dmp

Filesize
536KB

Download
memory/536-56-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/536-55-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/536-66-0x0000000001DB0000-0x0000000001E36000-memory.dmp

Filesize
536KB

Download
memory/536-68-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/536-69-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/1456-65-0x0000000000000000-mapping.dmp

Download
memory/1956-58-0x0000000000000000-mapping.dmp

Download
memory/1956-67-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads