92025c595d1a8e503aed2725ef9e64ef4ea919307c2694ffd564993ee4b64d43

General

Target

tmp.exe
Size

3.1MB
MD5

fdb8415567c0748a3bd4ffb9ac783cb7
SHA1

dbc51b3b102a1fd0fffa2dd5d2809c6e385d6a82
SHA256

92025c595d1a8e503aed2725ef9e64ef4ea919307c2694ffd564993ee4b64d43
SHA512

4335ed11f768209edff90f4611b7ea9ec3ca40daa39eea98cd6cf62bf4a51e1d94d2aa3b3d42b51abb834d2954aaccf84006c6d2af3065b8f35f3b505f3674c2
SSDEEP

98304:BE45G/DTclFuOqW6KGZKZhHRhZBiTdpU8:BE450QuO9xJZhHHic8

Score

8^/10

evasion spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

bc4e-f706-b21d-dbf9mrupdsrv.exe

pid process

1720 bc4e-f706-b21d-dbf9
1228 mrupdsrv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1720	bc4e-f706-b21d-dbf9
1228	mrupdsrv.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

tmp.exemrupdsrv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mrupdsrv.exe

Drops file in System32 directory 1 IoCs

Processes:

mrupdsrv.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\Update Service\us\d9bf774acb mrupdsrv.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\Update Service\us\d9bf774acb	mrupdsrv.exe

Drops file in Program Files directory 2 IoCs

Processes:

bc4e-f706-b21d-dbf9

description	ioc	process
File created	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	bc4e-f706-b21d-dbf9
File opened for modification	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	bc4e-f706-b21d-dbf9

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

tmp.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Internet Explorer\Main tmp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Internet Explorer\Main	tmp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

tmp.exemrupdsrv.exe

pid	process
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
1228	mrupdsrv.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe
3364	tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 3364 wrote to memory of 1720	3364	tmp.exe	bc4e-f706-b21d-dbf9
PID 3364 wrote to memory of 1720	3364	tmp.exe	bc4e-f706-b21d-dbf9
PID 3364 wrote to memory of 1720	3364	tmp.exe	bc4e-f706-b21d-dbf9

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mrupdsrv.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mrupdsrv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	mrupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\bc4e-f706-b21d-dbf9
"C:\Users\Admin\AppData\Local\Temp\bc4e-f706-b21d-dbf9" --install
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1720

C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
"C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\ProgramData\Mail.Ru\Id
Filesize
38B

MD5
707dca884498a034604f3767eb28c731

SHA1
941869e1da7aa394bcfe9f2a7a7e9dd592c1d819

SHA256
e3cfae28e2f5db1345f3a4f8ab3d0af5056adc0c775bba22e0d49a297e9100b0

SHA512
40f35623425e49c4ce34517a8d44f9a73ed2ba20ede3b275bcf00e4e9629ea2481300bbb14e7fa00630fd04c73fd1425297abd232184f25a812d5e43d32d6eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc4e-f706-b21d-dbf9
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc4e-f706-b21d-dbf9
Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads