fa4b986944e52bceeee9297054e7983a083fede6d0eb4d4ef53c7d1370c2f200

General

Target

e326b3ba48f867480c20c9f06d5cd655.exe
Size

1003KB
MD5

e326b3ba48f867480c20c9f06d5cd655
SHA1

6981d88ebf2ffbf320c155c6bfd7c286de38ff83
SHA256

fa4b986944e52bceeee9297054e7983a083fede6d0eb4d4ef53c7d1370c2f200
SHA512

4bbfa47cdb44137095f1f677c9d080f4bd011d086ceaf46577cd9d6795a4d0bf18db5f9f56736a20333614357aebd5f8c32078002e6a481168685dd1f6c06ef7
SSDEEP

24576:GhIXH6/zRSw3VB8/DIbYvrrN+d8wrvAta4eCT:GhuHWV3VSSYv/od8wTAta4NT

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2012	e326b3ba48f867480c20c9f06d5cd655.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	e326b3ba48f867480c20c9f06d5cd655.exe

Loads dropped DLL 1 IoCs

pid	Process
2552	e326b3ba48f867480c20c9f06d5cd655.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015c71-11.dat	upx
behavioral1/memory/2552-1-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral1/files/0x0009000000015c71-15.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2696	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	e326b3ba48f867480c20c9f06d5cd655.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	e326b3ba48f867480c20c9f06d5cd655.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2552	e326b3ba48f867480c20c9f06d5cd655.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2552	e326b3ba48f867480c20c9f06d5cd655.exe
2012	e326b3ba48f867480c20c9f06d5cd655.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2012	2552	e326b3ba48f867480c20c9f06d5cd655.exe	18
PID 2552 wrote to memory of 2012	2552	e326b3ba48f867480c20c9f06d5cd655.exe	18
PID 2552 wrote to memory of 2012	2552	e326b3ba48f867480c20c9f06d5cd655.exe	18
PID 2552 wrote to memory of 2012	2552	e326b3ba48f867480c20c9f06d5cd655.exe	18
PID 2012 wrote to memory of 2696	2012	e326b3ba48f867480c20c9f06d5cd655.exe	22
PID 2012 wrote to memory of 2696	2012	e326b3ba48f867480c20c9f06d5cd655.exe	22
PID 2012 wrote to memory of 2696	2012	e326b3ba48f867480c20c9f06d5cd655.exe	22
PID 2012 wrote to memory of 2696	2012	e326b3ba48f867480c20c9f06d5cd655.exe	22
PID 2012 wrote to memory of 2664	2012	e326b3ba48f867480c20c9f06d5cd655.exe	25
PID 2012 wrote to memory of 2664	2012	e326b3ba48f867480c20c9f06d5cd655.exe	25
PID 2012 wrote to memory of 2664	2012	e326b3ba48f867480c20c9f06d5cd655.exe	25
PID 2012 wrote to memory of 2664	2012	e326b3ba48f867480c20c9f06d5cd655.exe	25
PID 2664 wrote to memory of 2612	2664	cmd.exe	23
PID 2664 wrote to memory of 2612	2664	cmd.exe	23
PID 2664 wrote to memory of 2612	2664	cmd.exe	23
PID 2664 wrote to memory of 2612	2664	cmd.exe	23

C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe
"C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe
  C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe" /TN qm2lmOfce5f6 /F
    3⤵
    - Creates scheduled task(s)
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN qm2lmOfce5f6 > C:\Users\Admin\AppData\Local\Temp\ctsdr.xml
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Query /XML /TN qm2lmOfce5f6
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctsdr.xml

Filesize
1KB

MD5
5c38b7ba2f7d56dddb8640c41d081ade

SHA1
a2b0e88abe49574d72dadedff2b3c4fce1c2d0eb

SHA256
abf37848b83f2b46f23036859a7fb0502172bae647fa9925dee937c66afd168f

SHA512
749b59e14daf64ff4ae37bb1022d9a71ecdcfe0335ef9e8df10ccd96f4a087ed62f4d2a4487e4da81f2b8fd2e52662182745b1aa9934df31028703b66c9e2048

Download Submit
C:\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe

Filesize
221KB

MD5
3568ea6bad73d19cc8a1882c0cdf7401

SHA1
6549c2e033028fab3580ac132432eb787fc3e6a5

SHA256
3172e1d2adf1568b47dd5d69aa28dcb21a3d29d461de3e9865001747e74b91ef

SHA512
c808d45c27ed6a2231c62d7912be93b44b0a92824180047c7d95553dd7755ae383a8587e0617e9b7fa23057908d076d3bf95f8155b83d7ecd432983b2ed2a5ab

Download Submit
\Users\Admin\AppData\Local\Temp\e326b3ba48f867480c20c9f06d5cd655.exe

Filesize
276KB

MD5
e140f06ac496f661bea201afb78e2066

SHA1
e744765c47e99f81973ff7e1391f0870f0afc7a3

SHA256
67080b2f401e7ff236532eb83803fc67d1c62a0776f1cc667a46916d9d1a1c7a

SHA512
65d23a9a392f9c4dba8e9eb27b0ed74a8a2771196d5dc931803142f4e6842588369a4b941ce1d29aa7f1d3bb1c76a51bb7bd2146e2b1781add2ccaf7e95ccbec

Download Submit
memory/2012-20-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/2012-22-0x0000000000350000-0x00000000003CE000-memory.dmp

Filesize
504KB

Download
memory/2012-29-0x0000000000470000-0x00000000004DB000-memory.dmp

Filesize
428KB

Download
memory/2012-26-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2012-45-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/2552-17-0x0000000022FF0000-0x000000002324C000-memory.dmp

Filesize
2.4MB

Download
memory/2552-3-0x00000000001A0000-0x000000000021E000-memory.dmp

Filesize
504KB

Download
memory/2552-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2552-16-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2552-1-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/2552-44-0x0000000022FF0000-0x000000002324C000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads