e5b2fec0c5c8cd40e200c99ebf633d5f9dbc187ee24d8ecd88ab9fb3e2217361

General

Target

3d506f3a42cd179ff7adaba5781f30d4.exe
Size

18KB
MD5

3d506f3a42cd179ff7adaba5781f30d4
SHA1

22dff2a0ff3d659ce72fa68983968688fa733a0e
SHA256

e5b2fec0c5c8cd40e200c99ebf633d5f9dbc187ee24d8ecd88ab9fb3e2217361
SHA512

03075ca94ae31ff496809511efaa764f5e4e2519d5f89dd066479f35bf280d9270b011a27ddea06b95f1b33de64ec8a9fc88537cb8e1175540a17ea9a863f9cd
SSDEEP

384:zAMbrzR6wH1pyKVSA+e9dzLbSlVFJAxvr6+e9Pfqbn1v1:zhzR6wH/PVSATx+ha5v

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000d0000000122ca-9.dat	aspack_v212_v242
behavioral1/memory/2656-10-0x00000000003E0000-0x00000000003EE000-memory.dmp	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	Rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\Rundll32.exe"	3d506f3a42cd179ff7adaba5781f30d4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Rundll32.exe	3d506f3a42cd179ff7adaba5781f30d4.exe
File opened for modification	C:\Windows\Rundll32.exe	3d506f3a42cd179ff7adaba5781f30d4.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	Rundll32.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Start Page	Rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	3d506f3a42cd179ff7adaba5781f30d4.exe
2712	Rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2712	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	28
PID 2656 wrote to memory of 2792	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	29
PID 2656 wrote to memory of 2792	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	29
PID 2656 wrote to memory of 2792	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	29
PID 2656 wrote to memory of 2792	2656	3d506f3a42cd179ff7adaba5781f30d4.exe	29

C:\Users\Admin\AppData\Local\Temp\3d506f3a42cd179ff7adaba5781f30d4.exe
"C:\Users\Admin\AppData\Local\Temp\3d506f3a42cd179ff7adaba5781f30d4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\Rundll32.exe
  C:\Windows\Rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious use of SetWindowsHookEx
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\killme.bat
  2⤵
  - Deletes itself
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\killme.bat

Filesize
91B

MD5
679fe6a8f51765e07fb207d8a4e93f0a

SHA1
88b17e7b4917c1ad99928d7a83db19b626d529cb

SHA256
6b3cdeccfc81f0fd6caa2841600fe09aceff08daf31d7a3c31ce52d5c31d8a66

SHA512
bc013e2e65010129d9237d7bdc0ad4af34e8cadcf97018f8b3a2d2e00d49f3501ddca9a2499dc36b805a242d63eef1b2ea83e7633514022fe19e4f4b45a2251d

Download Submit
C:\Windows\Rundll32.exe

Filesize
18KB

MD5
3d506f3a42cd179ff7adaba5781f30d4

SHA1
22dff2a0ff3d659ce72fa68983968688fa733a0e

SHA256
e5b2fec0c5c8cd40e200c99ebf633d5f9dbc187ee24d8ecd88ab9fb3e2217361

SHA512
03075ca94ae31ff496809511efaa764f5e4e2519d5f89dd066479f35bf280d9270b011a27ddea06b95f1b33de64ec8a9fc88537cb8e1175540a17ea9a863f9cd

Download Submit
memory/2656-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2656-10-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2656-21-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2712-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2712-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads