92025c595d1a8e503aed2725ef9e64ef4ea919307c2694ffd564993ee4b64d43

General

Target

tmp.exe
Size

3.1MB
MD5

fdb8415567c0748a3bd4ffb9ac783cb7
SHA1

dbc51b3b102a1fd0fffa2dd5d2809c6e385d6a82
SHA256

92025c595d1a8e503aed2725ef9e64ef4ea919307c2694ffd564993ee4b64d43
SHA512

4335ed11f768209edff90f4611b7ea9ec3ca40daa39eea98cd6cf62bf4a51e1d94d2aa3b3d42b51abb834d2954aaccf84006c6d2af3065b8f35f3b505f3674c2
SSDEEP

98304:BE45G/DTclFuOqW6KGZKZhHRhZBiTdpU8:BE450QuO9xJZhHHic8

Score

8^/10

evasion spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

2611-2fd0-3c8c-a052mrupdsrv.exe

pid process

2736 2611-2fd0-3c8c-a052
2640 mrupdsrv.exe
Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

1564 tmp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2736	2611-2fd0-3c8c-a052
2640	mrupdsrv.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

tmp.exemrupdsrv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mrupdsrv.exe

Drops file in System32 directory 3 IoCs

Processes:

tmp.exemrupdsrv.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	tmp.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	tmp.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\Update Service\us\d9bf774acb	mrupdsrv.exe

Drops file in Program Files directory 2 IoCs

Processes:

2611-2fd0-3c8c-a052

description	ioc	process
File created	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	2611-2fd0-3c8c-a052
File opened for modification	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	2611-2fd0-3c8c-a052

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

tmp.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main tmp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	tmp.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

mrupdsrv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mrupdsrv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mrupdsrv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mrupdsrv.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

tmp.exemrupdsrv.exe

pid	process
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
2640	mrupdsrv.exe
1564	tmp.exe
2640	mrupdsrv.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
2640	mrupdsrv.exe
2640	mrupdsrv.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe
1564	tmp.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052
PID 1564 wrote to memory of 2736	1564	tmp.exe	2611-2fd0-3c8c-a052

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mrupdsrv.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mrupdsrv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	mrupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\2611-2fd0-3c8c-a052
"C:\Users\Admin\AppData\Local\Temp\2611-2fd0-3c8c-a052" --install
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2736

C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
"C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\ProgramData\Mail.Ru\Id
Filesize
38B

MD5
2bf0ad4b68e202f1f4f5ae8aa85592c8

SHA1
619210be83fd5b382db27009a609cc828c7e1f2b

SHA256
c40899c86fe49e0abb9d2bf1d44bc070cf5bb6627258e10e4e43194f39687beb

SHA512
1b03726edd2cf8981256e4da84636ae8789f920902ac161567a60a41422f10bb67278a610bc9f7dd86f50843bc7651cb798f52c0489c0bb1c903f9cc67f4c681

Download Submit
C:\Users\Admin\AppData\Local\Temp\2611-2fd0-3c8c-a052
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\Users\Admin\AppData\Local\Temp\2611-2fd0-3c8c-a052
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
\Users\Admin\AppData\Local\Temp\2611-2fd0-3c8c-a052
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads