bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d

General

Target

bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe
Size

1.2MB
MD5

daa8bb7d1098853808f1be0eb34db449
SHA1

58674dacdf4336d3a19bd80dcf5fd9076ede0389
SHA256

bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d
SHA512

dd090f514056293db0ce26b7504c772e3ed31c23fd3b67549a5f5f88dbebecca94fc1f9aff2c4d5b2379741f8dbbde12e15d8d1edaecbac8b734cf1d80ec0694
SSDEEP

24576:NieoSFV+TdT6iZZsK7DIc4XMS+SL9qtquBkjp4KBVfwyWQo0tn4VcCUeXX4:NzFM5THZZsKpcM1SL9SNHcno0d4OY4

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000009eff-138.dat	acprotect

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	´ó·É1027°æ.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	´ó·É1027°æ.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000022dde-134.dat	upx
behavioral2/files/0x0003000000022dde-135.dat	upx
behavioral2/memory/2076-137-0x0000000000400000-0x00000000006A0000-memory.dmp	upx
behavioral2/files/0x0006000000009eff-138.dat	upx
behavioral2/memory/2076-140-0x0000000000400000-0x00000000006A0000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	´ó·É1027°æ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	´ó·É1027°æ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	´ó·É1027°æ.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	´ó·É1027°æ.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft	´ó·É1027°æ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}	´ó·É1027°æ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}"	´ó·É1027°æ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft"	´ó·É1027°æ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InProcServer32	´ó·É1027°æ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32	´ó·É1027°æ.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft"	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft"	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dm.dll"	´ó·É1027°æ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InProcServer32\ThreadingModel = "Apartment"	´ó·É1027°æ.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2076	´ó·É1027°æ.exe
2076	´ó·É1027°æ.exe
2076	´ó·É1027°æ.exe
2076	´ó·É1027°æ.exe
2076	´ó·É1027°æ.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4808	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	81
PID 4836 wrote to memory of 4808	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	81
PID 4836 wrote to memory of 4808	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	81
PID 4836 wrote to memory of 2076	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	82
PID 4836 wrote to memory of 2076	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	82
PID 4836 wrote to memory of 2076	4836	bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe	82

C:\Users\Admin\AppData\Local\Temp\bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe
"C:\Users\Admin\AppData\Local\Temp\bc615b4fb8dd7cebdbcd4e2ac2da048895962aa32b063c845fa77ae74cf7d25d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dafei.vbs"
  2⤵
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\´ó·É1027°æ.exe
  "C:\Users\Admin\AppData\Local\Temp\´ó·É1027°æ.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dafei.vbs

Filesize
602B

MD5
7311cbcfc89c90c1f72af79f7a4defa4

SHA1
fec07effaf95ce4daefd51bfed436ebae8697014

SHA256
4f4d2dc8ff71c2468b1b2162788135440ee1e796624bf9fd8dbb20e51e943b44

SHA512
c3a8861d1e66ece597619fcb98e5b6d2870f953200efce20f12a1ce78a86fe9358034d2da82ffce494c9c43094c9faa68eb5641987549096e7d2515c97210fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dm.dll

Filesize
448KB

MD5
7a035d5dd03ea5c5b92261454fa73604

SHA1
c0cfba428cdcf95dd3160e68ba5ec4fe75cf3e33

SHA256
d88e6fa19b86db8a6fa8e061d7368d245a850c723591ec806c5407c14fb1df05

SHA512
bb44ba00d088741da891dd72325fc4305d2b5f6350e878180198dbda13cd4ac1623e40bdbb3ad8755e40ae15ab347f4ecf8455f24be88d86dd09ba3483f8369b

Download Submit
C:\Users\Admin\AppData\Local\Temp\´ó·É1027°æ.exe

Filesize
1.2MB

MD5
896f2201f849b72b7f4b52ecca5a6392

SHA1
4816158956c5a0329ee0c3d6c147c129273b517b

SHA256
64f98e884072651324c80f046e5cb73db05356908f6328a76a3917934b2f083a

SHA512
4b57092177568c6ec252752225d4d807ee5565f3956b1d7ad25f2d47a35cafbca62fe155e91c3c510ad2e52c2d3b0099244103e4ac472f1b8e56fedc0f5abacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\´ó·É1027°æ.exe

Filesize
1.2MB

MD5
896f2201f849b72b7f4b52ecca5a6392

SHA1
4816158956c5a0329ee0c3d6c147c129273b517b

SHA256
64f98e884072651324c80f046e5cb73db05356908f6328a76a3917934b2f083a

SHA512
4b57092177568c6ec252752225d4d807ee5565f3956b1d7ad25f2d47a35cafbca62fe155e91c3c510ad2e52c2d3b0099244103e4ac472f1b8e56fedc0f5abacf

Download Submit
memory/2076-133-0x0000000000000000-mapping.dmp

Download
memory/2076-137-0x0000000000400000-0x00000000006A0000-memory.dmp

Filesize
2.6MB

Download
memory/2076-139-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/2076-140-0x0000000000400000-0x00000000006A0000-memory.dmp

Filesize
2.6MB

Download
memory/2076-141-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/4808-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing