5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28

General

Target

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
Size

362KB
MD5

d77fa14d6295188b4af7954b3c8f1a38
SHA1

7acef1bd3b324546c91862eb5f54773d1d28df20
SHA256

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28
SHA512

f016d54979979d2ff649764e57c6b048cf3fc690cc1aa0b743c1be985f58b4705636b67487c8fb5bee48251a459cc33ffd478a434e3668e0e86cb7a0fabef184
SSDEEP

6144:x7/8yCh1wTvyk4vr4RNvKaJlllbXXPyCO8E7ih/kN5CtH9k8ryIV5G8Cb++1tdv:x77BTjCMRZfJlXf/O8mIICtH7HCb+6tt

Score

9^/10

collection discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\msidrz32.dll	acprotect
\Windows\SysWOW64\msidrz32.dll	acprotect
\Windows\SysWOW64\msidrz32.dll	acprotect
\Windows\SysWOW64\msidrz32.dll	acprotect
C:\Windows\SysWOW64\msidrz32.dll	acprotect

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1632-55-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1632-59-0x0000000000400000-0x000000000046C000-memory.dmp	upx
\Windows\SysWOW64\msidrz32.dll	upx
\Windows\SysWOW64\msidrz32.dll	upx
\Windows\SysWOW64\msidrz32.dll	upx
\Windows\SysWOW64\msidrz32.dll	upx
C:\Windows\SysWOW64\msidrz32.dll	upx
behavioral1/memory/1356-70-0x0000000010000000-0x0000000010088000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1356 rundll32.exe
1356 rundll32.exe
1356 rundll32.exe
1356 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msidrz32.dll,XzXRQcUSq"	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msidrz32.dll	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
File opened for modification	C:\Windows\SysWOW64\msidrz32.dll	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

604 1632 WerFault.exe 5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

pid	pid_target	process	target process
604	1632	WerFault.exe	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

pid	process
1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

description	pid	process	target process
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 1356	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	rundll32.exe
PID 1632 wrote to memory of 604	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	WerFault.exe
PID 1632 wrote to memory of 604	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	WerFault.exe
PID 1632 wrote to memory of 604	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	WerFault.exe
PID 1632 wrote to memory of 604	1632	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe	WerFault.exe

outlook_win_path 1 IoCs

Processes:

5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe

C:\Users\Admin\AppData\Local\Temp\5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe
"C:\Users\Admin\AppData\Local\Temp\5195bd647e93ce3bbb304e507e551318929279334527d65c6286018d48cdad28.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1632

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe msidrz32.dll,XzXRQcUSq
2⤵
- Loads dropped DLL
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 340
2⤵
- Program crash
PID:604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msidrz32.dll
Filesize
174KB

MD5
e8f30e1c5099edd4ee2d24cad67c333c

SHA1
bcd3f120cb6d99ef27e7bcc8822ca3d9b40faa4b

SHA256
cbfb7f70b2442f72d4172f349d0d92686dd864e223438e2331f3741a796852f7

SHA512
883d6a71a2c7dd48b6fc1f54198666678e0b4ed2a3d77109bdad06491faa16635d0d7452f62f8c69a4d309fabed61e4acad9cdfd315440cb2f70925ff7d0b4f1

Download Submit
\Windows\SysWOW64\msidrz32.dll
Filesize
174KB

MD5
e8f30e1c5099edd4ee2d24cad67c333c

SHA1
bcd3f120cb6d99ef27e7bcc8822ca3d9b40faa4b

SHA256
cbfb7f70b2442f72d4172f349d0d92686dd864e223438e2331f3741a796852f7

SHA512
883d6a71a2c7dd48b6fc1f54198666678e0b4ed2a3d77109bdad06491faa16635d0d7452f62f8c69a4d309fabed61e4acad9cdfd315440cb2f70925ff7d0b4f1

Download Submit
\Windows\SysWOW64\msidrz32.dll
Filesize
174KB

MD5
e8f30e1c5099edd4ee2d24cad67c333c

SHA1
bcd3f120cb6d99ef27e7bcc8822ca3d9b40faa4b

SHA256
cbfb7f70b2442f72d4172f349d0d92686dd864e223438e2331f3741a796852f7

SHA512
883d6a71a2c7dd48b6fc1f54198666678e0b4ed2a3d77109bdad06491faa16635d0d7452f62f8c69a4d309fabed61e4acad9cdfd315440cb2f70925ff7d0b4f1

Download Submit
\Windows\SysWOW64\msidrz32.dll
Filesize
174KB

MD5
e8f30e1c5099edd4ee2d24cad67c333c

SHA1
bcd3f120cb6d99ef27e7bcc8822ca3d9b40faa4b

SHA256
cbfb7f70b2442f72d4172f349d0d92686dd864e223438e2331f3741a796852f7

SHA512
883d6a71a2c7dd48b6fc1f54198666678e0b4ed2a3d77109bdad06491faa16635d0d7452f62f8c69a4d309fabed61e4acad9cdfd315440cb2f70925ff7d0b4f1

Download Submit
\Windows\SysWOW64\msidrz32.dll
Filesize
174KB

MD5
e8f30e1c5099edd4ee2d24cad67c333c

SHA1
bcd3f120cb6d99ef27e7bcc8822ca3d9b40faa4b

SHA256
cbfb7f70b2442f72d4172f349d0d92686dd864e223438e2331f3741a796852f7

SHA512
883d6a71a2c7dd48b6fc1f54198666678e0b4ed2a3d77109bdad06491faa16635d0d7452f62f8c69a4d309fabed61e4acad9cdfd315440cb2f70925ff7d0b4f1

Download Submit
memory/604-64-0x0000000000000000-mapping.dmp

Download
memory/1356-70-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download
memory/1356-60-0x0000000000000000-mapping.dmp

Download
memory/1632-58-0x00000000022D0000-0x0000000002358000-memory.dmp

Filesize
544KB

Download
memory/1632-63-0x00000000022D0000-0x0000000002358000-memory.dmp

Filesize
544KB

Download
memory/1632-62-0x00000000002C0000-0x000000000031A000-memory.dmp

Filesize
360KB

Download
memory/1632-59-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1632-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1632-57-0x00000000022D0000-0x0000000002358000-memory.dmp

Filesize
544KB

Download
memory/1632-56-0x00000000002C0000-0x000000000031A000-memory.dmp

Filesize
360KB

Download
memory/1632-55-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads