dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38

General

Target

dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe
Size

1.2MB
MD5

082d65dc1e430c28971049249b6877d7
SHA1

2136c61315b4bb0a0dacfc0d9d3240fe2e45437e
SHA256

dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38
SHA512

b5f6162984b86cc29b382689036c18bb4d4fe496ac987b599bb29b1f30f1808dacf2d130383d2e7ba36adb9886fb10a43395a8b681f3484bc082f051d33fe1d0
SSDEEP

24576:IQnGBaU6f5PAawKJzfBT/UQxQKvrqzwOq9xev6pkxh:IujfU4zfaQ+KuzdqDW6Mh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2052-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-1-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-11-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-16-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-34-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-32-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-30-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-28-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-26-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-41-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-45-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-37-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-24-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-22-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2052-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://591314.org/?soft"	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://591314.org/?soft"	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2052	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe
2052	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe
2052	dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe

C:\Users\Admin\AppData\Local\Temp\dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe
"C:\Users\Admin\AppData\Local\Temp\dd286e66922d007c3a7ac6d761d12e42e82210f3f12ef1fd9f64b90226c0ea38.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-1-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-11-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-16-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-34-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-32-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-30-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-28-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-26-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-41-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-45-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-37-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-24-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-22-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2052-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads