a24d959ae807b4b4d2d9c012916d75ff9906071e188efc6fb70e79603e8dd4b8

General

Target

ViRuS/10.exe
Size

34KB
MD5

764c37641406a641632443ecaa546c10
SHA1

8da43e2bbfb019c370e028c5914e6fdad4288e95
SHA256

ad84d652581c49c7a966d4a581543b17b07b1c10b9cd5d9529cf955071210ce2
SHA512

92f6e33c990d13e8901fd413df97a0a2b00a4fedd022f76336a6f2fc67d5d3e537c6edf697247582123a941771916ed78938d1405feb922db70ac518c1916cc8
SSDEEP

768:rc05slHBjNk91nSZWn2StE83/8WsgWp8M:rc05Ehja9ZtnhdA78

Score

8^/10

evasion spyware stealer upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
1456	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1456	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2060-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral3/memory/2060-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral3/memory/2060-23-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	10.exe
File created	C:\Windows\SysWOW64\sysapp19.dll	10.exe
File created	C:\Windows\SysWOW64\ksuser.dll	10.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	10.exe
File created	C:\Windows\SysWOW64\midimap.dll	10.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	10.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	10.exe
File created	C:\Windows\SysWOW64\msimg32.dll	10.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	10.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	10.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	10.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2780	sc.exe
2332	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2060	10.exe
2060	10.exe
2060	10.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	10.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2208	2060	10.exe	28
PID 2060 wrote to memory of 2208	2060	10.exe	28
PID 2060 wrote to memory of 2208	2060	10.exe	28
PID 2060 wrote to memory of 2208	2060	10.exe	28
PID 2060 wrote to memory of 2780	2060	10.exe	30
PID 2060 wrote to memory of 2780	2060	10.exe	30
PID 2060 wrote to memory of 2780	2060	10.exe	30
PID 2060 wrote to memory of 2780	2060	10.exe	30
PID 2060 wrote to memory of 2332	2060	10.exe	32
PID 2060 wrote to memory of 2332	2060	10.exe	32
PID 2060 wrote to memory of 2332	2060	10.exe	32
PID 2060 wrote to memory of 2332	2060	10.exe	32
PID 2208 wrote to memory of 2704	2208	net.exe	34
PID 2208 wrote to memory of 2704	2208	net.exe	34
PID 2208 wrote to memory of 2704	2208	net.exe	34
PID 2208 wrote to memory of 2704	2208	net.exe	34
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37
PID 2060 wrote to memory of 1456	2060	10.exe	37

C:\Users\Admin\AppData\Local\Temp\ViRuS\10.exe
"C:\Users\Admin\AppData\Local\Temp\ViRuS\10.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    PID:2704
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2780
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1703825015.dat, ServerMain c:\users\admin\appdata\local\temp\virus\10.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1703825015.dat

Filesize
34KB

MD5
684b9a54be3e2d5ba4aab54e99cf21c7

SHA1
cf3b2bcd2a82667d16d0c375edd082e325976548

SHA256
ca3a15613d99fdbe84e35422c3a564bf18f3ea225885bc3b5696c1eb32d35881

SHA512
dfd7d5acf5898e8d0f784783696bc6208c6c004f38da571bf41c8d3236c7cdef8f75e6998bd654d7461169eb45569fc9fde275a213549e1fcdafeba6b649bf4d

Download Submit
memory/2060-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2060-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2060-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing