3d55b037cd4d9041de0e54b74c146c698d185c124fad6a889309ce0878ddfc1d

General

Target

380b05c750732bd4c0887d90c684b5de.exe
Size

45KB
MD5

380b05c750732bd4c0887d90c684b5de
SHA1

1be814a2f68acf74e6d716e2b4a87be870ee1e5e
SHA256

3d55b037cd4d9041de0e54b74c146c698d185c124fad6a889309ce0878ddfc1d
SHA512

b2a6a1252a52a0992d67a8b34e267196507ff0c78599cf6bfc759fb187f4e510eb17b098c92da22d4760f6e9814008702c54ddb255da0779fd0aafd3fd49b0bb
SSDEEP

768:gdcI0SjL+ejzE7z/hcwFlrGGIaxuNplzTNCjKY50x:jSjLzE/fFlqNplzTNcjY

Score

10^/10

adware persistence stealer upx

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebProxy = "{A744F16C-B2D5-4138-81A2-085CDFCDE83A}"	380b05c750732bd4c0887d90c684b5de.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\Version = "1,0,0,2"	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\ = "Systray component"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\Locale = "EN"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\StubPath = "rundll32 sxmg4.dll,InitModule"	380b05c750732bd4c0887d90c684b5de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\IsInstalled = "1"	380b05c750732bd4c0887d90c684b5de.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000300000001e982-4.dat	acprotect
behavioral2/files/0x000300000001e982-3.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	380b05c750732bd4c0887d90c684b5de.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-5-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral2/files/0x000300000001e982-4.dat	upx
behavioral2/files/0x000300000001e982-3.dat	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}	380b05c750732bd4c0887d90c684b5de.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sxmg4.dll	380b05c750732bd4c0887d90c684b5de.exe
File created	C:\Windows\SysWOW64\sft.res	380b05c750732bd4c0887d90c684b5de.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\index.html	380b05c750732bd4c0887d90c684b5de.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\ProgID	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\InProcServer32	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\ = "Microsoft copyright"	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\InprocServer32	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\TypeLib	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\TypeLib\ = "{C8691316-2034-4350-9A66-6AE2FD9EE257}"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\InprocServer32\ = "sxmg4.dll"	380b05c750732bd4c0887d90c684b5de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\InprocServer32\ThreadingModel = "Apartment"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}\ProgID\ = "MS"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\ = "WebProxy"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\InProcServer32\ = "sxmg4.dll"	380b05c750732bd4c0887d90c684b5de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}\InProcServer32\ThreadingModel = "Apartment"	380b05c750732bd4c0887d90c684b5de.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4624	1480	380b05c750732bd4c0887d90c684b5de.exe	28
PID 1480 wrote to memory of 4624	1480	380b05c750732bd4c0887d90c684b5de.exe	28
PID 1480 wrote to memory of 4624	1480	380b05c750732bd4c0887d90c684b5de.exe	28

C:\Users\Admin\AppData\Local\Temp\380b05c750732bd4c0887d90c684b5de.exe
"C:\Users\Admin\AppData\Local\Temp\380b05c750732bd4c0887d90c684b5de.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies Installed Components in the registry
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\380B05~1.EXE >> NUL
  2⤵
  PID:3588
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s sxmg4.dll
  2⤵
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sxmg4.dll

Filesize
10KB

MD5
da75366ea6738c6363c9381ee49d16f8

SHA1
34bb8566ca0c18587d1c841d872774af27fc2f97

SHA256
8779969cf9ca7ed3ba3ef5568c44d5110403fb9d0eca45525486faf253e924a5

SHA512
810475ba53c8b076806745ca5b6cc10d78eb32120852ce4b97faf47581e9d0ca8f422a86bc57d1f344717877daaa83bcf54b1bbc279e315e770edcb0c05293fb

Download Submit
C:\Windows\SysWOW64\sxmg4.dll

Filesize
24KB

MD5
283d1021ecab1236f6c063d04d65bb45

SHA1
e902bf782b764528890f3bd2e3deeac6f3401601

SHA256
2b0469e0f2b196882e68278949ea325a7783229aeae47e9fa712d629cfdfe13d

SHA512
5c9e88677ad04cc1663c1de128b5d78ee6614b050479a3dd07f6d3f1984f3ade344f8680a214ad7849827e887fb92d3e2401d4485100e4346cc8278d18a997a9

Download Submit
memory/4624-5-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads