d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7

General

Target

657fabcb9803eda028948c584d99ac0f.exe
Size

108KB
MD5

657fabcb9803eda028948c584d99ac0f
SHA1

cf9fc9c7d5daca76dff4efaddb307f4e8a9dc6b2
SHA256

d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7
SHA512

80c3caa243936ace8e8ca975eaef93bbbc765988bf9e4ee2a76b57d17244cd7f9850295647d70528547a398475868dda06b805fc18992ee134727e38427a29bb
SSDEEP

1536:i7Sd58O1HWrblE0jsxMQRQuIZ+aMmt4JL3CUAGD6W5KkMh6vg2P5jyRzsWKOM:i79ltQRclJt4hyp2KJhUDZmwWKf

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
348	avpsvr.exe
232	avpcon.exe
2636	avpcon.exe
2244	avpcon.exe
1108	avpcon.exe
372	avpcon.exe
1912	avpcon.exe
4344	avpcon.exe
2204	avpcon.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023157-2.dat	upx
behavioral2/memory/348-3-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/348-5-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/files/0x0007000000023150-7.dat	upx
behavioral2/memory/232-8-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-11-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/232-12-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/2636-16-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-17-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/2244-20-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-21-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/1108-24-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-25-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/348-27-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/372-28-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1912-32-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-33-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/4344-37-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4344-36-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/348-38-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/2204-41-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	avpcon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	avpcon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	avpcon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\ESE\	avpcon.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\avpcon.exe	657fabcb9803eda028948c584d99ac0f.exe
File created	C:\Windows\avpsvr.exe	657fabcb9803eda028948c584d99ac0f.exe
File opened for modification	C:\Windows\webs	avpcon.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.xrwz.com"	avpcon.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
348	avpsvr.exe
348	avpsvr.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
232	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
2636	avpcon.exe
2636	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
2244	avpcon.exe
2244	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
1108	avpcon.exe
1108	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
372	avpcon.exe
372	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
1912	avpcon.exe
1912	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
4344	avpcon.exe
4344	avpcon.exe
348	avpsvr.exe
348	avpsvr.exe
2204	avpcon.exe
2204	avpcon.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 232	348	avpsvr.exe	97
PID 348 wrote to memory of 232	348	avpsvr.exe	97
PID 348 wrote to memory of 232	348	avpsvr.exe	97
PID 348 wrote to memory of 2636	348	avpsvr.exe	99
PID 348 wrote to memory of 2636	348	avpsvr.exe	99
PID 348 wrote to memory of 2636	348	avpsvr.exe	99
PID 348 wrote to memory of 2244	348	avpsvr.exe	100
PID 348 wrote to memory of 2244	348	avpsvr.exe	100
PID 348 wrote to memory of 2244	348	avpsvr.exe	100
PID 348 wrote to memory of 1108	348	avpsvr.exe	101
PID 348 wrote to memory of 1108	348	avpsvr.exe	101
PID 348 wrote to memory of 1108	348	avpsvr.exe	101
PID 348 wrote to memory of 372	348	avpsvr.exe	102
PID 348 wrote to memory of 372	348	avpsvr.exe	102
PID 348 wrote to memory of 372	348	avpsvr.exe	102
PID 348 wrote to memory of 1912	348	avpsvr.exe	103
PID 348 wrote to memory of 1912	348	avpsvr.exe	103
PID 348 wrote to memory of 1912	348	avpsvr.exe	103
PID 348 wrote to memory of 4344	348	avpsvr.exe	104
PID 348 wrote to memory of 4344	348	avpsvr.exe	104
PID 348 wrote to memory of 4344	348	avpsvr.exe	104
PID 348 wrote to memory of 2204	348	avpsvr.exe	105
PID 348 wrote to memory of 2204	348	avpsvr.exe	105
PID 348 wrote to memory of 2204	348	avpsvr.exe	105

C:\Users\Admin\AppData\Local\Temp\657fabcb9803eda028948c584d99ac0f.exe
"C:\Users\Admin\AppData\Local\Temp\657fabcb9803eda028948c584d99ac0f.exe"
1⤵
- Drops file in Windows directory
PID:4060

C:\Windows\avpsvr.exe
C:\Windows\avpsvr.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpsvr.exe

Filesize
45KB

MD5
14eb92e040bba588cc160365e48e6313

SHA1
8acb97f3077bd90b30dd9812fceb52218823da71

SHA256
2ac6e7de5963e249726324d2fddf230082b551945ec78d047eaa0705980e764e

SHA512
34b16fb9e4bfd95c905885b6969334f17cc0f103ad7512ea9ed1ec1928369f209d1c656c6f87115ce372f23a9ba058091d81a486a139b87bf3705070885ee309

Download Submit
C:\Windows\webs

Filesize
26B

MD5
ed4383174bd7811aa9a3cb1a4734d91a

SHA1
2d94226f11d1b23d6e7c5cb45e3d1cbd78ca5bd7

SHA256
7b4dcedc38a01a4e7ca43e5bae624bc8e774f43fd6cf639b39077567fd0ee971

SHA512
d5e5a2c36547e3766083d0ed13d08846d943bfb9ee9d5bcd15fcae7f80144ef3e26548cb16e902e963f4c1e855ee516b0b2528013afd6a4d57071e70eda1ab12

Download Submit
memory/232-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/232-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/348-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/348-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/372-28-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1108-24-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1912-32-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2204-41-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2244-20-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2636-16-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4344-37-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4344-36-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads