2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c

General

Target

2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
Size

1.3MB
MD5

558bc602b25b8db9b378f2fd0e9afae3
SHA1

c4c07ad217b8fe7ca6af747237244385abfa2d84
SHA256

2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c
SHA512

a26cda0e85f39f4d242ec83a31e840e0eb7443ca0760c64a09c578da969f9a57a1fb7de3a4ae285f7cbf3ae4cf15fbed3612747234134915af43d92e87084ab2
SSDEEP

24576:3Vuewq/OJLLGnVqiIKeISpq63lZE4u+N31+TRFnb168CqwO:luewqMGnr5yYnT/nJ5Cq

Score

8^/10

evasion persistence vmprotect

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\psP19GEP\ImagePath = "\\??\\C:\\windows\\DaDa\\psP19GEP.dll"	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 1 IoCs

pid	Process
4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023201-2.dat	vmprotect
behavioral2/memory/4600-8-0x0000000075490000-0x0000000075501000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023201-6.dat	vmprotect
behavioral2/memory/4600-7-0x0000000075490000-0x0000000075501000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023203-14.dat	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\VMDisk_d64.sys	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
File opened for modification	C:\Windows\system32\VMDisk_d64.sys	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DaDa\EVRootCA.reg	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
File created	C:\windows\DaDa\psP19GEP.dll	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
File opened for modification	C:\windows\DaDa\psP19GEP.dll	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1708	sc.exe
3592	sc.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3776	regedit.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3776	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	86
PID 4600 wrote to memory of 3776	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	86
PID 4600 wrote to memory of 3776	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	86
PID 4600 wrote to memory of 2460	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	87
PID 4600 wrote to memory of 2460	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	87
PID 4600 wrote to memory of 2460	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	87
PID 2460 wrote to memory of 1708	2460	CMD.exe	89
PID 2460 wrote to memory of 1708	2460	CMD.exe	89
PID 2460 wrote to memory of 1708	2460	CMD.exe	89
PID 4600 wrote to memory of 4832	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	90
PID 4600 wrote to memory of 4832	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	90
PID 4600 wrote to memory of 4832	4600	2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe	90
PID 4832 wrote to memory of 3592	4832	CMD.exe	92
PID 4832 wrote to memory of 3592	4832	CMD.exe	92
PID 4832 wrote to memory of 3592	4832	CMD.exe	92

C:\Users\Admin\AppData\Local\Temp\2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe
"C:\Users\Admin\AppData\Local\Temp\2c67c5e549d71c1c680f5c96936a7d48435c8d73bd8fafed5b5a8493cdfa999c.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\windows\DaDa\EVRootCA.reg
  2⤵
  - Runs .reg file with regedit
  PID:3776
- C:\Windows\SysWOW64\CMD.exe
  CMD /C SC STOP psP19GEP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    SC STOP psP19GEP
    3⤵
    - Launches sc.exe
    PID:1708
- C:\Windows\SysWOW64\CMD.exe
  CMD /C SC DELETE psP19GEP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\sc.exe
    SC DELETE psP19GEP
    3⤵
    - Launches sc.exe
    PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mouse.dll

Filesize
215KB

MD5
eaef212d2415803e6f3f3cc7724bdd5c

SHA1
70185e704470a689f33b15a69bd9429e51f203d8

SHA256
c495a028ee6a7a3bca32c6e501a5cf1cd25a9b57cc2b3f42d371cadd3ce0a5c5

SHA512
aa2e9010d4a34d7c1730a16b91ec01096781ecf379b5022ad2c113fc58052f1490986eb36e73e1d92627204fa941ea08c9302ca997c07c0a30f4af9819f8b3ee

Download Submit
C:\Mouse.dll

Filesize
215KB

MD5
eaef212d2415803e6f3f3cc7724bdd5c

SHA1
70185e704470a689f33b15a69bd9429e51f203d8

SHA256
c495a028ee6a7a3bca32c6e501a5cf1cd25a9b57cc2b3f42d371cadd3ce0a5c5

SHA512
aa2e9010d4a34d7c1730a16b91ec01096781ecf379b5022ad2c113fc58052f1490986eb36e73e1d92627204fa941ea08c9302ca997c07c0a30f4af9819f8b3ee

Download Submit
C:\Mouse.sys

Filesize
209KB

MD5
cdb82b2a52d037737529f4286fcf4911

SHA1
1805516a93c3fdd020e43417d5090c35a98acc17

SHA256
42af0a1520918facedff5684e35c525e3157ed91d363aefb64d2f0cd5a3f3e4b

SHA512
d032970375d039d73275f252319aa896f9cdd343832fb26e7a7453d6e9fba252de12e31f074f0362198fe0f0e045512c336b2530fecf50cbd002af6fe6ff5eb6

Download Submit
memory/4600-8-0x0000000075490000-0x0000000075501000-memory.dmp

Filesize
452KB

Download
memory/4600-7-0x0000000075490000-0x0000000075501000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads