e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09

General

Target
e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe
Size 595KB
Sample221204-akbabsdg8v
SHA256 e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09
MD5 ea762d424a8595a4786ec0e07b6b5e80
SHA1 cbe4867508999564ae148eb9776c8727e7f4336d
SHA512 b01ca241f0a5fc96d05b646b2cc7ec0cf2b295d829dcb77ab3a9dd97608cf2a60494eb80593d442ddb7ffcfec40faef21cd0df9c1f9900296c017739280ffe9f
SSDEEP 12288:9OYfK4At9yLwWy51k1wifib/qTjEOBXcorB7E5bMiTEgF3xSWZ3iQ:ZVwW6kNib/0EOBXTtmMiTFrf3r
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000900000002317e-134.dat	aspack_v212_v242
behavioral2/files/0x000900000002317e-135.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1364	360cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360antiarp = "C:\\WINDOWS\\SysWOW64\\360cmd.exe"	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\360cmd.exe	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe
File created	C:\WINDOWS\SysWOW64\1.jpg	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe
File created	C:\WINDOWS\SysWOW64\bat.bat	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1048	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	taskkill.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe
1364	360cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1364	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	81
PID 224 wrote to memory of 1364	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	81
PID 224 wrote to memory of 1364	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	81
PID 1364 wrote to memory of 3292	1364	360cmd.exe	84
PID 1364 wrote to memory of 3292	1364	360cmd.exe	84
PID 1364 wrote to memory of 3292	1364	360cmd.exe	84
PID 224 wrote to memory of 2316	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	85
PID 224 wrote to memory of 2316	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	85
PID 224 wrote to memory of 2316	224	e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe	85
PID 2316 wrote to memory of 1048	2316	cmd.exe	88
PID 2316 wrote to memory of 1048	2316	cmd.exe	88
PID 2316 wrote to memory of 1048	2316	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe
"C:\Users\Admin\AppData\Local\Temp\e338e7b99e83b7353645bdd1d2d0f52bad789a85825f95a0b3ea7484fb2f8c09.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:224
- C:\WINDOWS\SysWOW64\360cmd.exe
  C:\WINDOWS\system32\360cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\WINDOWS\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 360antiarp /t REG_SZ /d "C:\WINDOWS\SysWOW64\360cmd.exe" /f
    3⤵
    - Adds Run key to start application
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\bat.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im qq.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360cmd.exe

Path C:\WINDOWS\SysWOW64\360cmd.exe
Size 516KB
SHA256 0a8b59f654b1bce8b867270731e137799daf8079bd867169bc0ee44fda1f29db
MD5 0ec344088329ff3d6aa1e6578fd4347a
SHA1 ad0f5018fe83dcbab28fded1e14a028562b53239
SHA512 2efc9d24f9cb3a9aa7dbc193e79d1205b1b4a656a5c4cd107708dc32a943c0290feaa6544fa85d20bcaa12471a7b441bf5c3abb01c7c01a0efc9189fb976a3da
SSDEEP 12288:COYfK4At9yLwWy51k1wifib/qTjEOBXcorB7E5bMiTEgF3:4VwW6kNib/0EOBXTtmMiTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bat.bat

Path C:\WINDOWS\SysWOW64\bat.bat
Size 36B
SHA256 53431def92a00e70658b879ab2653d2c3a471827f77523b57542733b91423d91
MD5 520cd8fadafccf37f476c8db526c0a97
SHA1 9226c5d1db5ffe85e69a7457fb41b3cfdff2b74b
SHA512 c65cf1ec125a02d9a1fa8781681440330918679375bf54fe384784d2262e355c8d53d2dabc3d06f6e1ae07e2af9110db251f7a322b2d4b4e75f905aea697792d
MD5 SHA1 SHA512

Submit Download

360cmd.exe

Path C:\Windows\SysWOW64\360cmd.exe
Size 516KB
SHA256 0a8b59f654b1bce8b867270731e137799daf8079bd867169bc0ee44fda1f29db
MD5 0ec344088329ff3d6aa1e6578fd4347a
SHA1 ad0f5018fe83dcbab28fded1e14a028562b53239
SHA512 2efc9d24f9cb3a9aa7dbc193e79d1205b1b4a656a5c4cd107708dc32a943c0290feaa6544fa85d20bcaa12471a7b441bf5c3abb01c7c01a0efc9189fb976a3da
SSDEEP 12288:COYfK4At9yLwWy51k1wifib/qTjEOBXcorB7E5bMiTEgF3:4VwW6kNib/0EOBXTtmMiTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-132-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1364-136-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/1364-139-0x0000000002410000-0x000000000247D000-memory.dmp

Download

memory/1364-142-0x0000000000400000-0x0000000000539000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads