e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899

General

Target

e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
Size

264KB
MD5

5c6b90025fac19d745d6e6c4110212d1
SHA1

5b49f3097f3622b1f1772ed01fcf999b4442c7dd
SHA256

e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899
SHA512

8632feba10bc44bff19fa1acdaf80040492d85bbb6894dab9b78c4a942e81262a70538d2aed9c6ed258a390368a23d518529201e99c06b7c6ea485177afb97f7
SSDEEP

6144:SJmf5b8P77Ksjvv08w1kZkhcMocHNbChYnz8bdLoNOn:pBbSbvv08w1wkhXoDyIpLoN

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00090000000139f7-57.dat	aspack_v212_v242
behavioral1/files/0x00090000000139f7-58.dat	aspack_v212_v242
behavioral1/files/0x0006000000014142-60.dat	aspack_v212_v242

Loads dropped DLL 2 IoCs

pid	Process
1932	regsvr32.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaaa_hg = "C:\\Windows\\system32\\hgaaaa.exe"	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aaaaie0.dll	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
File opened for modification	C:\Windows\SysWOW64\hgaaaa0.dll	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
File created	C:\Windows\SysWOW64\hgaaaa0.dll	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
File opened for modification	C:\Windows\SysWOW64\hgaaaa.exe	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
File created	C:\Windows\SysWOW64\hgaaaa.exe	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
File opened for modification	C:\Windows\SysWOW64\aaaaie0.dll	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1932	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	27
PID 1948 wrote to memory of 1256	1948	e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe	10

C:\Users\Admin\AppData\Local\Temp\e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe
"C:\Users\Admin\AppData\Local\Temp\e86fdf3c78851a8aa12fa6ca82f4f8b13fcafcf2cc4c3ef257d0d47f24f23899.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\aaaaie0.dll
  2⤵
  - Loads dropped DLL
  PID:1932

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\aaaaie0.dll

Filesize
97KB

MD5
d39613a68ae50f013902b69b1e111712

SHA1
9171c866473fd63df6552dcff7ffc08f550053db

SHA256
3607dd30999b428d86a7a9a32f0a3bef6a04cb746b8370445781a34c73287faf

SHA512
e38237fec0595d5a056a2dccf058ebf24383668eeda39529891ac0a9f46a799cd102701414b551bb72ccee1eaae724e93068fea52002123cf46bab33f0153528

Download Submit
\Windows\SysWOW64\aaaaie0.dll

Filesize
97KB

MD5
d39613a68ae50f013902b69b1e111712

SHA1
9171c866473fd63df6552dcff7ffc08f550053db

SHA256
3607dd30999b428d86a7a9a32f0a3bef6a04cb746b8370445781a34c73287faf

SHA512
e38237fec0595d5a056a2dccf058ebf24383668eeda39529891ac0a9f46a799cd102701414b551bb72ccee1eaae724e93068fea52002123cf46bab33f0153528

Download Submit
\Windows\SysWOW64\hgaaaa0.dll

Filesize
106KB

MD5
e9c678b5ffd8df2d1876d56a3b900120

SHA1
7269b5cd908afe7aecdf39de0a236bf909cf69da

SHA256
31d039bbf7ab769c0fd7b29c45796e14a88c5a2c8db2cdea8769222d0df31c8a

SHA512
0b8718d25ac8ca197fb1a22ed61bb093a54933bcceeed6d9067a57dec6139c21227c1b27eded133946fe68a65eeb92a57ee3ed6799121fe1346a1578a07b319f

Download Submit
memory/1932-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1932-59-0x0000000010000000-0x000000001006E000-memory.dmp

Filesize
440KB

Download
memory/1948-55-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1948-61-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing