4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f

General

Target

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Size

2.5MB
MD5

6044815a509bd93d9138a53703c3c67f
SHA1

f6514efcbec925ed96eec3b38b7b8d465f639952
SHA256

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f
SHA512

37ec3f9f11bf5c0ba31d030f8c2e1c9809ac0f144a8a8f20bb82e3c73993052da474cdfeb49a9a7861a0ffc53006aff7852dae36f67893f5fe7dbc5f764afb24
SSDEEP

49152:0BtkSsGmCzv0MGxhST+YcITKSYeibmmYvJR/DvAQwDWY3xqOrAlk:0BLO4FUeiCmYvAQw73cXlk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x0000000000935000-memory.dmp	upx
behavioral1/memory/1732-8-0x00000000001F0000-0x00000000001FB000-memory.dmp	upx
behavioral1/memory/1732-7-0x00000000001F0000-0x00000000001FB000-memory.dmp	upx
behavioral1/memory/1732-10-0x0000000000400000-0x0000000000935000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?28879"	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Start Page	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
1732	4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

C:\Users\Admin\AppData\Local\Temp\4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe
"C:\Users\Admin\AppData\Local\Temp\4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732

Network

DNS

sp.kulove123.com

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

8.8.8.8:53

Request

sp.kulove123.com

IN A

Response

sp.kulove123.com

IN CNAME

iduxxob.qiniudns.com

iduxxob.qiniudns.com

IN CNAME

tinyglobalcdnweb.qiniu.com.w.kunlunar.com

tinyglobalcdnweb.qiniu.com.w.kunlunar.com

IN A

47.246.48.211
GET

http://sp.kulove123.com/NIP.dat

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

47.246.48.211:80

Request

GET /NIP.dat HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: sp.kulove123.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: Tengine
Content-Type: application/x-ns-proxy-autoconfig
Content-Length: 170
Connection: keep-alive
Date: Tue, 01 Aug 2023 05:24:41 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="NIP.dat"; filename*=utf-8''NIP.dat
Content-Md5: ADX5KYeMWmIU80NS8O1BOw==
Content-Transfer-Encoding: binary
Etag: "FsVKpzoq4CAm1gg1Bz2UUF2Y2Auf"
Last-Modified: Tue, 24 Mar 2020 16:29:59 GMT
X-Log: X-Log
X-M-Log: QNM:xs444;QNM3
X-M-Reqid: 4C0AACywYvMDK3cX
X-Qiniu-Zone: 0
X-Qnm-Cache: Hit
X-Reqid: 9R8AAADx_C9VJHYX
X-Svr: IO
Ali-Swift-Global-Savetime: 1690867481
Via: cache2.l2de2[0,46,206-0,H], cache12.l2de2[49,0], cache8.nl2[0,0,200-0,H], cache5.nl2[15,0]
Age: 2358871
X-Cache: HIT TCP_MEM_HIT dirn:11:327592090
X-Swift-SaveTime: Mon, 21 Aug 2023 23:39:17 GMT
X-Swift-CacheTime: 798324
Timing-Allow-Origin: *
EagleId: 2ff6309916932263523957991e
GET

http://sp.kulove123.com/yzxy.txt

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

47.246.48.211:80

Request

GET /yzxy.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: sp.kulove123.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: Tengine
Content-Type: text/plain
Content-Length: 1
Connection: keep-alive
Date: Sat, 19 Aug 2023 06:59:09 GMT
Cache-Control: public, max-age=31536000
Etag: "FrZYn8arDcgs8SCZ0cLUCrmU6EEM"
X-M-Log: QNM:xs1186;QNM3/304
X-M-Reqid: rm4AAHwpnAaetnwX
X-Qnm-Cache: Hit
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Content-Disposition: inline; filename="yzxy.txt"; filename*=utf-8''yzxy.txt
Content-Transfer-Encoding: binary
Last-Modified: Thu, 02 Feb 2017 07:30:37 GMT
Vary: Accept-Encoding
X-Log: X-Log
X-Qiniu-Zone: 0
X-Reqid: XXEAAAC5Mvbwt2UX
X-Svr: IO
Ali-Swift-Global-Savetime: 1692428349
Via: cache4.l2de2[0,0,206-0,H], cache20.l2de2[2,0], cache8.nl2[0,0,200-0,H], cache5.nl2[3,0]
Age: 798004
X-Cache: HIT TCP_MEM_HIT dirn:1:208352007
X-Swift-SaveTime: Mon, 21 Aug 2023 23:39:20 GMT
X-Swift-CacheTime: 2359189
Timing-Allow-Origin: *
EagleId: 2ff6309916932263537775497e
DNS

cs.kulove123.com

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

8.8.8.8:53

Request

cs.kulove123.com

IN A

Response

cs.kulove123.com

IN A

47.93.205.92
DNS

cs.kulove123.com

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

8.8.8.8:53

Request

cs.kulove123.com

IN A

Response

cs.kulove123.com

IN A

47.93.205.92
POST

http://cs.kulove123.com/mtmd-v5.php

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

Remote address:

47.93.205.92:80

Request

POST /mtmd-v5.php HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us)
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
Host: cs.kulove123.com
Content-Length: 23

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 28 Aug 2023 12:39:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=9fv9bcraaeqmkjiqd4b5u5b070; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

47.246.48.211:80

http://sp.kulove123.com/yzxy.txt

http

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

677 B
4.8kB
8
8

HTTP Request

GET http://sp.kulove123.com/NIP.dat

HTTP Response

200

HTTP Request

GET http://sp.kulove123.com/yzxy.txt

HTTP Response

200
47.93.205.92:80

http://cs.kulove123.com/mtmd-v5.php

http

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

800 B
668 B
9
5

HTTP Request

POST http://cs.kulove123.com/mtmd-v5.php

HTTP Response

200

8.8.8.8:53

sp.kulove123.com

dns

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

62 B
161 B
1
1

DNS Request

sp.kulove123.com

DNS Response

47.246.48.211
8.8.8.8:53

cs.kulove123.com

dns

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

62 B
78 B
1
1

DNS Request

cs.kulove123.com

DNS Response

47.93.205.92
8.8.8.8:53

cs.kulove123.com

dns

4b503e651c42aa2212d4e923b3b35c7dcecfc5e4a47e40657ac5d7260a0b178f.exe

62 B
78 B
1
1

DNS Request

cs.kulove123.com

DNS Response

47.93.205.92

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000000400000-0x0000000000935000-memory.dmp

Filesize
5.2MB

Download
memory/1732-8-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download
memory/1732-7-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download
memory/1732-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1732-10-0x0000000000400000-0x0000000000935000-memory.dmp

Filesize
5.2MB

Download
memory/1732-11-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.