f8734b4de9204b889305f097427258afa7ea6a9fbeb69d66b67666a3dbb8459e

General

Target

09198f19305e678a73292a5a1951a611.exe
Size

1002KB
MD5

09198f19305e678a73292a5a1951a611
SHA1

dda81bd800c2bb5766d933b67c0581ceea85ae74
SHA256

f8734b4de9204b889305f097427258afa7ea6a9fbeb69d66b67666a3dbb8459e
SHA512

2857d27cb648d9c2f6602252b7015effe950b7d783a9c99b0e61be25ba412e269751acf3a585a6bc5df7cdb580a76a8f4e0d78209b16e7ecda7333ec1c92956e
SSDEEP

24576:VuWQQyPG2vQW0BTEgSuvq5LFg+fsHlLQvUAvxEQXZCTEgg/:VuWXyfSTvS5LFg+Uy1vxwTvg/

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012281-3.dat	acprotect
behavioral1/memory/2112-5-0x0000000074DA0000-0x0000000074DA9000-memory.dmp	acprotect

Loads dropped DLL 5 IoCs

pid	Process
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012281-3.dat	upx
behavioral1/memory/2112-5-0x0000000074DA0000-0x0000000074DA9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\SOFTWARE\Microsoft\Internet Explorer\Main	09198f19305e678a73292a5a1951a611.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	09198f19305e678a73292a5a1951a611.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	09198f19305e678a73292a5a1951a611.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\tst_key = "test_ok"	09198f19305e678a73292a5a1951a611.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe
2112	09198f19305e678a73292a5a1951a611.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	09198f19305e678a73292a5a1951a611.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28
PID 2112 wrote to memory of 2392	2112	09198f19305e678a73292a5a1951a611.exe	28

C:\Users\Admin\AppData\Local\Temp\09198f19305e678a73292a5a1951a611.exe
"C:\Users\Admin\AppData\Local\Temp\09198f19305e678a73292a5a1951a611.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\ioSpecial.ini

Filesize
652B

MD5
826f72acda609aaa1280478843dbdf0f

SHA1
fee9b204b13b6b1a625067d7ee1222f754cd2fff

SHA256
958c481ef88949ac5adb1be1c408e8e5a2279224f62aceb741e66c5c68f004a3

SHA512
9ee40b21aa46ed6a69ee9b7a95359605eb018422799d27f18855b5151d92856ba1c20b4f56a8bf3cc9ddc59548554e072067abf1c4ce50a2eda92dffadb572e1

Download Submit
\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\SelfDel.dll

Filesize
4KB

MD5
7cff7fe2caea5184d98c147e7e263132

SHA1
21f39d3d0dd5f7198d67ef30e95d10ae3460093e

SHA256
281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101

SHA512
fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\mifuyjnad.dll

Filesize
557KB

MD5
cfd0c9d448f54ac769709e0031a47ae6

SHA1
00316e410406a6fe927e3f014526e84afa8024d8

SHA256
433ae28e10dff308a945af1932bd5555f51e123e5c13934015a587d25466d024

SHA512
4d342cf1e7639869cf2d6d66d55e6d87fec8b4bf595431c40cca5717dc246748b94fd586f1463e6baeb333f6d5ffd24a33fbc72277cdbb5785810c02c53b4f4b

Download Submit
\Users\Admin\AppData\Local\Temp\nsd80D4.tmp\nsProcEx.dll

Filesize
32KB

MD5
5f568bba9381c47f596492563514e350

SHA1
76e599040594144399a07febceb203a102436c79

SHA256
5cd30b2a26dc104173ef5fcda0cef66bafbb0849c466463f0e2db0fc42f5dc24

SHA512
ef7671d2ee56b7f81dd2fc0ecd322796003a8fca6b40efa8d84a25cfe4aa0ea149e83191f664de540fad63876957b9eea00e109e17bf81d125423eeb36769b5d

Download Submit
memory/2112-5-0x0000000074DA0000-0x0000000074DA9000-memory.dmp

Filesize
36KB

Download
memory/2112-22-0x0000000002400000-0x0000000002492000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing