92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183

General

Target

92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
Size

206KB
MD5

60890356f67490346d9ce559f35d163e
SHA1

ab3ce377f38805ee75e704c4d7014839c4274544
SHA256

92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183
SHA512

ce9d156cf1db57716b438a2967b76af66853f3046b64eb1de8926bc7a0cfc67be5adde8eb5afafaf201dd15a3dfcf132bbd16d4f7820433594ffec5a227a2914
SSDEEP

6144:hz1S19Yy+xnYXvNHygVjZKAOJ9b5yOSrc:hBUWavNSgVl6J9b5yOSrc

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000022e2f-133.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\king_mg = "C:\\Windows\\system32\\mgking.exe"	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mgking.exe	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
File created	C:\Windows\SysWOW64\mgking.exe	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
File opened for modification	C:\Windows\SysWOW64\mgking0.dll	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
File created	C:\Windows\SysWOW64\mgking0.dll	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4496	4616	WerFault.exe	80
4668	4616	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 724	4616	92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe
  "C:\Users\Admin\AppData\Local\Temp\92c1635ac2c2dcac39711f4dce157231fc89346878d5e808f7f4890af0fd4183.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 224
    3⤵
    - Program crash
    PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 336
    3⤵
    - Program crash
    PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 4616
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4616 -ip 4616
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mgking0.dll

Filesize
115KB

MD5
3798689833711d6100979e48b85516af

SHA1
e80ba5ff5c9e69d2285511b7b576f3e88d9e3de6

SHA256
0c2901326da0555b44dfb66782e83c80623aa98aee5c5b3d2c31ab5c70de2a15

SHA512
03d96641737cf9406b670c919d559c729c742a4ae85e7ff14131dfa2b15d5e229a7c0827b6ede97dc313548e38acea38763dcf0d842c59de61b5a770e8d70488

Download Submit
memory/4616-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4616-134-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/4616-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing