87b90eb874af9a986921362d59cd08536baee8d4935b5b858127cd8683b8998d

General

Target

21fd93d3cdbeb9ed94ce1d1cd48063cc.exe
Size

40KB
MD5

21fd93d3cdbeb9ed94ce1d1cd48063cc
SHA1

e377ba41cec9b79366ed22bd226bd88f1c88376f
SHA256

87b90eb874af9a986921362d59cd08536baee8d4935b5b858127cd8683b8998d
SHA512

356f124023d23124c1ad5fc9875e8e786f79a9e5d2ffa374d38ceea4d1b0485cfca25b9e5ed9674084aad8f25e944eef21e0a4bae970e66d9aae37661dc3dcc0
SSDEEP

768:YHyfK1MokyJwxoX0J026MFpzf98LbHJT70:uZMokOt26gzfKLrJn

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2756	netmodulr.exe
2788	netmodulr.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe
2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000e000000016d52-1.dat	upx
behavioral1/memory/2520-2-0x0000000000260000-0x0000000000270000-memory.dmp	upx
behavioral1/memory/2756-10-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2788-12-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2788-20-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\netmodulr.exe	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	netmodulr.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	netmodulr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}	netmodulr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}\WpadNetworkName = "Network 3"	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-36-a8-23-92-5b\WpadDecisionReason = "1"	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	netmodulr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	netmodulr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	netmodulr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}\WpadDecisionTime = 90ccedaf6c3fda01	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}\WpadDecision = "0"	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-36-a8-23-92-5b\WpadDecision = "0"	netmodulr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}\d6-36-a8-23-92-5b	netmodulr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-36-a8-23-92-5b\WpadDecisionTime = 90ccedaf6c3fda01	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	netmodulr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7A13BFAF-4E22-4B88-9457-D71391C72602}\WpadDecisionReason = "1"	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-36-a8-23-92-5b	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	netmodulr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	netmodulr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	netmodulr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	netmodulr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe
2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2756	2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe	28
PID 2520 wrote to memory of 2756	2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe	28
PID 2520 wrote to memory of 2756	2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe	28
PID 2520 wrote to memory of 2756	2520	21fd93d3cdbeb9ed94ce1d1cd48063cc.exe	28

C:\Users\Admin\AppData\Local\Temp\21fd93d3cdbeb9ed94ce1d1cd48063cc.exe
"C:\Users\Admin\AppData\Local\Temp\21fd93d3cdbeb9ed94ce1d1cd48063cc.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\netmodulr.exe
  C:\Windows\system32\netmodulr.exe -inst
  2⤵
  - Executes dropped EXE
  PID:2756

C:\Windows\SysWOW64\netmodulr.exe
C:\Windows\SysWOW64\netmodulr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\netmodulr.exe

Filesize
19KB

MD5
1071cf44d3e9cb1f8db0981257233c74

SHA1
473ebc7859875268db5d01ff37e25bac500f2cd8

SHA256
9a06615bfe4e5b7af84ab77f9993ec32da33e88233f764480edabce06cc9a254

SHA512
1aa9d6aec103a6185e80ae85ef948fb98aca13848297f3a13c0974faf7deea0e75b4b0d9655032e349ff717e85da31303fb3e4f4f38cff9f91d37eddd455918e

Download Submit
memory/2520-2-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2520-11-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2756-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2788-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2788-20-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing