ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81

General

Target

ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
Size

248KB
MD5

3c8fb4ac36692a2a3d3ebdf8fcf9e42a
SHA1

9dc35f559e145ff5a0c055284b1a1815644a632a
SHA256

ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81
SHA512

73b55eeb5b72f23dce0a86ff8b62065728ae0efdcfe273c467d6ccd7c75ec61d0ebf9586bcf0c35349c473c70984eaa066510eb86e009461a0c27c019c59fa0f
SSDEEP

6144:tXLD3bN7ivqkNHF5jNVi1TtbM2QSSUjVO6Cl:FLV7ivqSHDhc1BdUX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1468	xa240563406.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000022de0-133.dat	upx
behavioral2/files/0x0003000000022de0-134.dat	upx
behavioral2/memory/1468-135-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/memory/1468-136-0x0000000000400000-0x0000000000499000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe

Loads dropped DLL 1 IoCs

pid	Process
4748	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}\IExplore = "1"	regsvr32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xa240563406.exe	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
File created	C:\Windows\SysWOW64\xa240563609.exe	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
File opened for modification	C:\Windows\SysWOW64\xa240563609.exe	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
File created	C:\Windows\SysWOW64\wr63839.dll	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
File created	C:\Windows\SysWOW64\xwr63839.dll	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib\ = "{46512174-4910-35DA-B23D-5CB03CD54722}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}\ = "D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\xwr63839.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ = "ID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ = "ID"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\ = "LIB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}\InprocServer32\ = "C:\\Windows\\SysWow64\\xwr63839.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46512174-4910-35DA-B23D-5CB03CD54722}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib\ = "{46512174-4910-35DA-B23D-5CB03CD54722}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5D557D6-204F-3CC3-8AA6-01CBBDCCC577}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD82D37C-8C93-37AD-A250-7AD560014D99}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1468	xa240563406.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2820	AUDIODG.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1468	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	81
PID 4844 wrote to memory of 1468	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	81
PID 4844 wrote to memory of 1468	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	81
PID 4844 wrote to memory of 4748	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	83
PID 4844 wrote to memory of 4748	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	83
PID 4844 wrote to memory of 4748	4844	ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe	83

C:\Users\Admin\AppData\Local\Temp\ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe
"C:\Users\Admin\AppData\Local\Temp\ec28e66acbb5fb3125403c09906f2eb685807aaba74b5161d902a01dc8062f81.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\xa240563406.exe
  "C:\Windows\system32\xa240563406.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1468
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\xwr63839.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xa240563406.exe

Filesize
72KB

MD5
3913d9ce5b98c2aa1ca4d6b228aaf4c6

SHA1
e8b828301ebaab3fbde47db543f066cc01708c7f

SHA256
c571c11682836b0d0093b9230da0dac9b78d9269e745d82373dd97edcd2e7cbb

SHA512
d82ca759b31a1f42ba5c3d5afcf1c15883e63f5950041541c05bca8023118692c3557943064192b15eed54b55d2e5811973e7e80ce6057c6ced03162a176aa9f

Download Submit
C:\Windows\SysWOW64\xa240563406.exe

Filesize
72KB

MD5
3913d9ce5b98c2aa1ca4d6b228aaf4c6

SHA1
e8b828301ebaab3fbde47db543f066cc01708c7f

SHA256
c571c11682836b0d0093b9230da0dac9b78d9269e745d82373dd97edcd2e7cbb

SHA512
d82ca759b31a1f42ba5c3d5afcf1c15883e63f5950041541c05bca8023118692c3557943064192b15eed54b55d2e5811973e7e80ce6057c6ced03162a176aa9f

Download Submit
C:\Windows\SysWOW64\xwr63839.dll

Filesize
164KB

MD5
02a57281d986e8a06a19b8a62af14be0

SHA1
9372ac16597f87db89695538558a0876c79e3982

SHA256
b1087fd9eab282fbb246bbfa6f983a08178c5265f0c3454e392ba03f2367a975

SHA512
5576f7779983dd9d3d0a160c8154a3b57d4759a56da8b5bb5fe19113800c78b29f15458b1ef5676ceb577a129e48ace3b41825764dcd2104f9a5b13e70659df3

Download Submit
C:\Windows\SysWOW64\xwr63839.dll

Filesize
164KB

MD5
02a57281d986e8a06a19b8a62af14be0

SHA1
9372ac16597f87db89695538558a0876c79e3982

SHA256
b1087fd9eab282fbb246bbfa6f983a08178c5265f0c3454e392ba03f2367a975

SHA512
5576f7779983dd9d3d0a160c8154a3b57d4759a56da8b5bb5fe19113800c78b29f15458b1ef5676ceb577a129e48ace3b41825764dcd2104f9a5b13e70659df3

Download Submit
memory/1468-132-0x0000000000000000-mapping.dmp

Download
memory/1468-135-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1468-136-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/4748-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing