a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2

General

Target

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
Size

361KB
MD5

11237374706a36f4f556e6afa6feec71
SHA1

689f06cf6772a9bb6ea5eeb4764bf962f81a6080
SHA256

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2
SHA512

3084502dcc04451ee51ed820318cbed89f96f3c5bb6abcbddb4bb6526f913e61b5fee1ed7636ad12d16e17ee41d954516e2c18859afac39789ff441debaa9886
SSDEEP

6144:EttBiR4jOsq9aEsiUscu5H2wXXDdGMzWdvV0ZkrrC7/Z8p4xpfgMS8GXelP:E04WoEsiUo5H2OXoMzwvV0GraGCp4Mu

Score

9^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\msinaz32.dll	acprotect
C:\Windows\SysWOW64\msinaz32.dll	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4396-132-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4396-134-0x0000000000400000-0x000000000046B000-memory.dmp	upx
C:\Windows\SysWOW64\msinaz32.dll	upx
C:\Windows\SysWOW64\msinaz32.dll	upx
behavioral2/memory/5012-140-0x0000000010000000-0x0000000010086000-memory.dmp	upx
behavioral2/memory/4396-141-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5012 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5012	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msinaz32.dll,rbNCrnSwdubl"	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msinaz32.dll	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
File opened for modification	C:\Windows\SysWOW64\msinaz32.dll	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

788 4396 WerFault.exe a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

pid	pid_target	process	target process
788	4396	WerFault.exe	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

pid	process
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe

description	pid	process	target process
PID 4396 wrote to memory of 5012	4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 4396 wrote to memory of 5012	4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe
PID 4396 wrote to memory of 5012	4396	a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe
"C:\Users\Admin\AppData\Local\Temp\a290d756e3d27c0e84b07b316b228568b618a092aae6ff4abdf0f8a16e2db5b2.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe msinaz32.dll,rbNCrnSwdubl
2⤵
- Loads dropped DLL
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 684
2⤵
- Program crash
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4396 -ip 4396
1⤵
PID:3424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msinaz32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
C:\Windows\SysWOW64\msinaz32.dll
Filesize
172KB

MD5
f1495e1d8577d92f47d842b5a13bbbe4

SHA1
d16c0db41258901fa83b16fedaaaaedbe7cee1d3

SHA256
149ac596ec3e31105008cb71178102cd118dbe6b4e3cac52305d9a4fe53f4c9f

SHA512
4543cd7776fe717c9e16c46834d31828f8d30bde30576b056b5d4503a1896402c98be8dfee2f6bd69d93f1b2f21bd57c62b0fbdaac14135707fe9410a67f36df

Download Submit
memory/4396-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4396-133-0x00000000022A0000-0x00000000022FA000-memory.dmp

Filesize
360KB

Download
memory/4396-134-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4396-135-0x0000000002830000-0x00000000028B6000-memory.dmp

Filesize
536KB

Download
memory/4396-138-0x0000000002830000-0x00000000028B6000-memory.dmp

Filesize
536KB

Download
memory/4396-141-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/5012-136-0x0000000000000000-mapping.dmp

Download
memory/5012-140-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads