aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5

General

Target

aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
Size

381KB
MD5

0b8669f18f63db2f68d51369c7e1a45a
SHA1

fc102c4572e29c898ebdf6b879ef0fce0b4e38f6
SHA256

aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5
SHA512

9fbac49bddb1164f435958dbfa3e2b7f21c49f44fbc9e1f2d08d570d8a5cc1a3a8722539bf7964b7099ad88fe40c64f54291361e013129ef6f91201717df1505
SSDEEP

6144:ndjgZolSFcf87yQtH/me1Anluc8Sez6Z6OgMNCOecxeyuDvwU4H+pQDhyhHJFRvX:djgSlSf1tfme1GMcHXTlHzuDYUS+iIpd

Score

9^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0002000000021b43-137.dat	acprotect
behavioral2/files/0x0002000000021b43-138.dat	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-132-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral2/memory/4600-134-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral2/files/0x0002000000021b43-137.dat	upx
behavioral2/files/0x0002000000021b43-138.dat	upx
behavioral2/memory/1068-141-0x0000000010000000-0x0000000010086000-memory.dmp	upx
behavioral2/memory/4600-142-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1068	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSIDLL = "C:\\Windows\\SysWOW64\\rundll32.exe msipdd32.dll,VUrlGftroE"	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msipdd32.dll	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
File opened for modification	C:\Windows\SysWOW64\msipdd32.dll	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	4600	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1068	4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe	81
PID 4600 wrote to memory of 1068	4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe	81
PID 4600 wrote to memory of 1068	4600	aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe	81

C:\Users\Admin\AppData\Local\Temp\aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe
"C:\Users\Admin\AppData\Local\Temp\aa8548ae21c45e37e42a951cb0f9a2e3648a6acfb3f03ddb6d5bd1681b3c28a5.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe msipdd32.dll,VUrlGftroE
  2⤵
  - Loads dropped DLL
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 696
  2⤵
  - Program crash
  PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4600 -ip 4600
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msipdd32.dll

Filesize
173KB

MD5
ffc4093c7ae3dd6dca21796fc814ccd5

SHA1
4820709dc53003a87c3e507f5352b7595b060f7a

SHA256
42df8d39add01efe0b7199bb8c70c5c8ab07d317553be3cb46a9926e47482141

SHA512
6e7741b7b444a3129b7753a09396058711eddcd30dc2645212ac257281b6494122a94a30c352cb9e546f49ef0bf3d7e6497c410747087c4bfa93391c4f100084

Download Submit
C:\Windows\SysWOW64\msipdd32.dll

Filesize
173KB

MD5
ffc4093c7ae3dd6dca21796fc814ccd5

SHA1
4820709dc53003a87c3e507f5352b7595b060f7a

SHA256
42df8d39add01efe0b7199bb8c70c5c8ab07d317553be3cb46a9926e47482141

SHA512
6e7741b7b444a3129b7753a09396058711eddcd30dc2645212ac257281b6494122a94a30c352cb9e546f49ef0bf3d7e6497c410747087c4bfa93391c4f100084

Download Submit
memory/1068-141-0x0000000010000000-0x0000000010086000-memory.dmp

Filesize
536KB

Download
memory/4600-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-133-0x0000000002210000-0x000000000226A000-memory.dmp

Filesize
360KB

Download
memory/4600-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-135-0x00000000024B0000-0x0000000002536000-memory.dmp

Filesize
536KB

Download
memory/4600-139-0x0000000002210000-0x000000000226A000-memory.dmp

Filesize
360KB

Download
memory/4600-140-0x00000000024B0000-0x0000000002536000-memory.dmp

Filesize
536KB

Download
memory/4600-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing