13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a

General

Target

13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Size

2.5MB
MD5

c96c796d5c5ccbeb335c51bbc435fdc6
SHA1

6a31a3bd6f30bc52b37117db9fa351dbafe6b1d7
SHA256

13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a
SHA512

be5a2dc48c2349727b7dac9836efc42cea5ef85e1a7611b5bf921299a50d01c8178379ad2d94244cc9d38aecdaea828eda663854e4fa6a0bec1c2a0648a1138d
SSDEEP

49152:kwQ4FcQtZYW0JBvm7bO9xpVrpxMui5dz958hE8YxUpqCQXDa+mk:NFzYW0BvIOzpGuISWU0tDik

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2592-0-0x0000000000400000-0x0000000000932000-memory.dmp	upx
behavioral1/memory/2592-1-0x0000000000400000-0x0000000000932000-memory.dmp	upx
behavioral1/memory/2592-2-0x0000000000400000-0x0000000000932000-memory.dmp	upx
behavioral1/memory/2592-3-0x0000000000400000-0x0000000000932000-memory.dmp	upx
behavioral1/memory/2592-12-0x0000000000400000-0x0000000000932000-memory.dmp	upx
behavioral1/memory/2592-14-0x00000000002E0000-0x00000000002EB000-memory.dmp	upx
behavioral1/memory/2592-15-0x00000000002E0000-0x00000000002EB000-memory.dmp	upx
behavioral1/memory/2592-18-0x00000000002E0000-0x00000000002EB000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\0306D2.dll	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?28879"	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Start Page	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
464	Process not Found
464	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
2592	13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe

C:\Users\Admin\AppData\Local\Temp\13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe
"C:\Users\Admin\AppData\Local\Temp\13f81e723717b9d5099ccabb624eb6483b02ada9264aebd70b19d0f42af2841a.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-0-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/2592-1-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/2592-2-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/2592-3-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/2592-12-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/2592-14-0x00000000002E0000-0x00000000002EB000-memory.dmp

Filesize
44KB

Download
memory/2592-15-0x00000000002E0000-0x00000000002EB000-memory.dmp

Filesize
44KB

Download
memory/2592-16-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2592-18-0x00000000002E0000-0x00000000002EB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads