eeea39ef2c85647daaf61960cb1dd1dc762f7dd456ffed7671ee0fcb162898e9

General

Target

29fb00fec03fa4428682b7c4f98278d4.dll
Size

93KB
MD5

29fb00fec03fa4428682b7c4f98278d4
SHA1

aad473fd7592e3517c9d8acfa374dad0e153262f
SHA256

eeea39ef2c85647daaf61960cb1dd1dc762f7dd456ffed7671ee0fcb162898e9
SHA512

6947be2228a0ae0423a50154c99795a1ecc945e6541ae8059469dd0a9fa824395e82f92ec8c660c79e16ecaf034a6050a73a8d1f41c3ffcf57fd9c4dc57e11e6
SSDEEP

1536:tTi92M749gVNuAKlggBYQoUyFFKJHKw4QXIEbYjVJ/DyzkAIJZ0814zHPsJSDPw8:NuVIAuAKeguQoUyRwvYEbYjVdDyYbZ0T

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{975320EC-A864-531F-7531-0ECA975320EC}	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x008600000001b58d-6.dat	acprotect

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/files/0x008600000001b58d-6.dat	upx
behavioral2/memory/1096-8-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-9-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-10-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-11-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-12-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-13-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-14-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-15-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-16-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-17-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-18-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-19-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-20-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1096-21-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\JHFDBKI.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\JHFDBKI.dll	rundll32.exe
File created	C:\Windows\SysWOW64\TRPNWUS.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\TRPNWUS.dll	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{975320EC-A864-531F-7531-0ECA975320EC}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{975320EC-A864-531F-7531-0ECA975320EC}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{975320EC-A864-531F-7531-0ECA975320EC}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{975320EC-A864-531F-7531-0ECA975320EC}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{975320EC-A864-531F-7531-0ECA975320EC}\InprocServer32\ = "C:\\Windows\\SysWow64\\TRPNWUS.dll"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1096	1852	rundll32.exe	21
PID 1852 wrote to memory of 1096	1852	rundll32.exe	21
PID 1852 wrote to memory of 1096	1852	rundll32.exe	21

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29fb00fec03fa4428682b7c4f98278d4.dll,#1
1⤵
- Modifies Shared Task Scheduler registry keys
- Drops file in System32 directory
- Modifies registry class
PID:1096

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29fb00fec03fa4428682b7c4f98278d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\JHFDBKI.dll

Filesize
93KB

MD5
29fb00fec03fa4428682b7c4f98278d4

SHA1
aad473fd7592e3517c9d8acfa374dad0e153262f

SHA256
eeea39ef2c85647daaf61960cb1dd1dc762f7dd456ffed7671ee0fcb162898e9

SHA512
6947be2228a0ae0423a50154c99795a1ecc945e6541ae8059469dd0a9fa824395e82f92ec8c660c79e16ecaf034a6050a73a8d1f41c3ffcf57fd9c4dc57e11e6

Download Submit
memory/1096-14-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-15-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-10-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-11-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-12-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-8-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-13-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-16-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-17-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-18-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-19-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-20-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1096-21-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads