b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263

General

Target

b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Size

4.9MB
MD5

d270991916a314cda15ab0e1a91f780f
SHA1

98d5c008ec6b64958b3fdbd5918a75ebc6dcb9cd
SHA256

b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263
SHA512

6c69a5cbf9192c30b0f358c5e1947d3ac5e270213eb0216f4b0f3865d48f96fd018aa1c47f05587e350747c3ed759662655abe048fd72a5221c117d5faab70cc
SSDEEP

98304:3R8EftRdtsZ9XiTe5GrlEMoRhIt7V2vgtnWyR+BH0e8h20y/pWVrzXoX8mhYTL/v:3Vd1XosugCB8U/erA8LL/YoYCe+pG

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2192-0-0x0000000000400000-0x0000000000B55000-memory.dmp	upx
behavioral2/memory/2192-13069-0x0000000000400000-0x0000000000B55000-memory.dmp	upx
behavioral2/memory/2192-13070-0x0000000000400000-0x0000000000B55000-memory.dmp	upx
behavioral2/memory/2192-13077-0x0000000003720000-0x000000000372B000-memory.dmp	upx
behavioral2/memory/2192-13078-0x0000000003720000-0x000000000372B000-memory.dmp	upx
behavioral2/memory/2192-13080-0x0000000000400000-0x0000000000B55000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

pid	Process
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
2192	b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe

C:\Users\Admin\AppData\Local\Temp\b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe
"C:\Users\Admin\AppData\Local\Temp\b131b8fd34b69bcaf4221afcc53743532d87515313b0ae7884172cf801c13263.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000400000-0x0000000000B55000-memory.dmp

Filesize
7.3MB

Download
memory/2192-1-0x0000000076270000-0x0000000076485000-memory.dmp

Filesize
2.1MB

Download
memory/2192-3875-0x0000000076650000-0x00000000767F0000-memory.dmp

Filesize
1.6MB

Download
memory/2192-5884-0x00000000755B0000-0x000000007562A000-memory.dmp

Filesize
488KB

Download
memory/2192-13069-0x0000000000400000-0x0000000000B55000-memory.dmp

Filesize
7.3MB

Download
memory/2192-13070-0x0000000000400000-0x0000000000B55000-memory.dmp

Filesize
7.3MB

Download
memory/2192-13077-0x0000000003720000-0x000000000372B000-memory.dmp

Filesize
44KB

Download
memory/2192-13078-0x0000000003720000-0x000000000372B000-memory.dmp

Filesize
44KB

Download
memory/2192-13079-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2192-13080-0x0000000000400000-0x0000000000B55000-memory.dmp

Filesize
7.3MB

Download
memory/2192-13081-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads