df4adacafc2e2a13d1fbfcad58333d72516aef4a642c0edaa46c58393609bde2

General

Target

37c4b3187a66fb062d2baffa89cc2e33.exe
Size

1.3MB
MD5

37c4b3187a66fb062d2baffa89cc2e33
SHA1

9540728dc59b2738e77a0ac631776cead56a9cc4
SHA256

df4adacafc2e2a13d1fbfcad58333d72516aef4a642c0edaa46c58393609bde2
SHA512

ff579c8964ff6c675c8716ce2acd5e789723b01303987bf6ba316b653d7b88c852f61714298310c6de757b922c10674fa60223ec56e0bd33bab69e070eee7ded
SSDEEP

24576:Cs8p1CLEKeJmwOj09hLzAvCBnVMOaxkobWsCFbnLiCNXJ8wiuyl2Oxr13y+KqtWx:Cs8pMLEKUtdhLnKko3ClnL1N58wiuyB4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4092	svchost.exe
3180	setup.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4812-0-0x0000000000400000-0x000000000059F000-memory.dmp	upx
behavioral2/files/0x0006000000023230-7.dat	upx
behavioral2/files/0x0006000000023230-6.dat	upx
behavioral2/memory/4092-9-0x0000000000400000-0x000000000059F000-memory.dmp	upx
behavioral2/files/0x0006000000023232-14.dat	upx
behavioral2/memory/3180-15-0x0000000001000000-0x0000000001333000-memory.dmp	upx
behavioral2/files/0x0006000000023232-13.dat	upx
behavioral2/memory/4812-16-0x0000000000400000-0x000000000059F000-memory.dmp	upx
behavioral2/memory/4092-19-0x0000000000400000-0x000000000059F000-memory.dmp	upx
behavioral2/memory/3180-20-0x0000000001000000-0x0000000001333000-memory.dmp	upx
behavioral2/memory/3180-23-0x0000000001000000-0x0000000001333000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\Localdir\\svchost.exe"	37c4b3187a66fb062d2baffa89cc2e33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4812	37c4b3187a66fb062d2baffa89cc2e33.exe
4092	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4092	4812	37c4b3187a66fb062d2baffa89cc2e33.exe	22
PID 4812 wrote to memory of 4092	4812	37c4b3187a66fb062d2baffa89cc2e33.exe	22
PID 4812 wrote to memory of 4092	4812	37c4b3187a66fb062d2baffa89cc2e33.exe	22
PID 4092 wrote to memory of 3180	4092	svchost.exe	25
PID 4092 wrote to memory of 3180	4092	svchost.exe	25
PID 4092 wrote to memory of 3180	4092	svchost.exe	25

C:\Users\Admin\AppData\Local\Temp\37c4b3187a66fb062d2baffa89cc2e33.exe
"C:\Users\Admin\AppData\Local\Temp\37c4b3187a66fb062d2baffa89cc2e33.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\Localdir\svchost.exe
  C:\Users\Admin\Localdir\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\Localdir\setup.exe
    C:\Users\Admin\Localdir\setup.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Localdir\setup.exe

Filesize
164KB

MD5
56d3ea5da34bfad5b1c753805e2a6379

SHA1
c932ce446efb805aaa52ea3a5869570b52779362

SHA256
e6a1e29ceacd629770eaa17350028f4826e8b53e71d9789ce6cbb08a2b479d36

SHA512
7d0ce9735b1994fe1e12b224213b22be8ac043231eb845823fade03b6a9119eaedfd27622dfa0c0e7593f7bafb48f534e63a10bd3ded1f3b8ccb4787cacc8597

Download Submit
C:\Users\Admin\Localdir\setup.exe

Filesize
130KB

MD5
d0dc52fe6a8ae80d7d9eed67e304403d

SHA1
7b2cd3b0b7a8f39856e80fa31b83223af6f81987

SHA256
c391992949bb3b1b8dba2d8911b08d32ab27062576a12371c6cc86b2312204ca

SHA512
61b07e58fe62b1d0858a696d438fcf34ba3b5b7d910f0b196f28f9e8fbb3118520e2c714ae8e340d37a8b02e51c66784140b62b7152f8f26bceff8548ee7613c

Download Submit
C:\Users\Admin\Localdir\svchost.exe

Filesize
149KB

MD5
d0dbc2778147371bb1a5eb838d1a2c7f

SHA1
43ecf071b93b826872811246f48630a1c40d3753

SHA256
f2a0611c2882fa5b92d9d4cf8570ffc81bb69d8ddc7695328e21c7175e8796a8

SHA512
38d736846909facff22c308ea5764e20798dc205e0fd79a4e4b9d592a4c3fb6d2b54175b746ab511bc8d34395838c63066164f67dcf6b890d6a9c30a1c94efba

Download Submit
C:\Users\Admin\Localdir\svchost.exe

Filesize
167KB

MD5
5e31aabd82e6c1b0a0ceea57fad5950c

SHA1
a5e061b7af68c3b7498f9ef800ae9a47681cf26b

SHA256
568882a5614b4bf3ded4878aaf34099bfa9874cb063cabf29dc5a9c59bca3116

SHA512
ce9e4181a3b4ac6e6915fff1bec584bb4df411f01c5c911611b9f3b0f652d0aea926782e8292cedf8169b787442769368b6cd2ad7ff403e30334581833f93b83

Download Submit
memory/3180-15-0x0000000001000000-0x0000000001333000-memory.dmp

Filesize
3.2MB

Download
memory/3180-20-0x0000000001000000-0x0000000001333000-memory.dmp

Filesize
3.2MB

Download
memory/3180-23-0x0000000001000000-0x0000000001333000-memory.dmp

Filesize
3.2MB

Download
memory/4092-9-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4092-19-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4812-0-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4812-16-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads