9000b186651a4389dfecf30354bbfa452501220863f4361891706bb30e0994cb

General

Target

756f5010dd57e69b4b15084cb5980e38.exe
Size

821KB
MD5

756f5010dd57e69b4b15084cb5980e38
SHA1

b75dbd093c0c0f3ea6526ef29d57519b93011f73
SHA256

9000b186651a4389dfecf30354bbfa452501220863f4361891706bb30e0994cb
SHA512

5f6eade747a3567c55c0641979aeed60af9bc5a73c3fd6e6f4b7abdaa5eb052bc2ade3956893e2ed4fdd5261a040a63ae8b2084057c17aa503f5fa8b07a8e663
SSDEEP

12288:c4ryVyeGnvjsWnRNw9/y5CIUHv8HV44IqvoRcfNhflO9dJ5IECpxOokLZsCtQw1l:5ryVr0+yYhPUVdIqQ6fcjukL2CDYO

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1996	756f5010dd57e69b4b15084cb5980e38.exe

Executes dropped EXE 1 IoCs

pid	Process
1996	756f5010dd57e69b4b15084cb5980e38.exe

Loads dropped DLL 1 IoCs

pid	Process
2540	756f5010dd57e69b4b15084cb5980e38.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral1/files/0x000c000000012242-11.dat	upx
behavioral1/memory/2540-16-0x0000000022F90000-0x00000000231EC000-memory.dmp	upx
behavioral1/files/0x000c000000012242-17.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2700	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	756f5010dd57e69b4b15084cb5980e38.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	756f5010dd57e69b4b15084cb5980e38.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	756f5010dd57e69b4b15084cb5980e38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	756f5010dd57e69b4b15084cb5980e38.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2540	756f5010dd57e69b4b15084cb5980e38.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2540	756f5010dd57e69b4b15084cb5980e38.exe
1996	756f5010dd57e69b4b15084cb5980e38.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1996	2540	756f5010dd57e69b4b15084cb5980e38.exe	29
PID 2540 wrote to memory of 1996	2540	756f5010dd57e69b4b15084cb5980e38.exe	29
PID 2540 wrote to memory of 1996	2540	756f5010dd57e69b4b15084cb5980e38.exe	29
PID 2540 wrote to memory of 1996	2540	756f5010dd57e69b4b15084cb5980e38.exe	29
PID 1996 wrote to memory of 2700	1996	756f5010dd57e69b4b15084cb5980e38.exe	30
PID 1996 wrote to memory of 2700	1996	756f5010dd57e69b4b15084cb5980e38.exe	30
PID 1996 wrote to memory of 2700	1996	756f5010dd57e69b4b15084cb5980e38.exe	30
PID 1996 wrote to memory of 2700	1996	756f5010dd57e69b4b15084cb5980e38.exe	30
PID 1996 wrote to memory of 2788	1996	756f5010dd57e69b4b15084cb5980e38.exe	32
PID 1996 wrote to memory of 2788	1996	756f5010dd57e69b4b15084cb5980e38.exe	32
PID 1996 wrote to memory of 2788	1996	756f5010dd57e69b4b15084cb5980e38.exe	32
PID 1996 wrote to memory of 2788	1996	756f5010dd57e69b4b15084cb5980e38.exe	32
PID 2788 wrote to memory of 2836	2788	cmd.exe	33
PID 2788 wrote to memory of 2836	2788	cmd.exe	33
PID 2788 wrote to memory of 2836	2788	cmd.exe	33
PID 2788 wrote to memory of 2836	2788	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe
"C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe
  C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe" /TN QxutJGth3fd4 /F
    3⤵
    - Creates scheduled task(s)
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN QxutJGth3fd4 > C:\Users\Admin\AppData\Local\Temp\oIGW4.xml
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN QxutJGth3fd4
      4⤵
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe

Filesize
560KB

MD5
fc6754c2f7ce1d284d3c0ff64bb747f6

SHA1
7d096c8c9ead933743fcc74f99d95225f14d9968

SHA256
7a58885ee896537c94c1058b45a05e9b1a1b34cee1dc0a548236329bd4b17e20

SHA512
1e11eb545cdd7aaaeef06bdd828d2e8deb9f009ca35e8c845921cd2155fbcfa5019e7d539e827d970c0ac28349827f6e5d36a81663912439a7cc4ded5701185a

Download Submit
\Users\Admin\AppData\Local\Temp\756f5010dd57e69b4b15084cb5980e38.exe

Filesize
475KB

MD5
07663af4e07e5978a87c8b2aea284200

SHA1
4c0e93b7bbe0128f6147d9bd59fce37e244b6c19

SHA256
488ff48e4e8fa8c9b92321f93daaee1805d66c28168c032f95f0adca7c20367c

SHA512
1bd15fade705a379f1a62ff99d6eddf08bd40ca9720be4c32a685d12b0530a45a19e45e5fb002dea11de783956e59a7b4be35b41a264f6ac94dca0b443c7c4aa

Download Submit
memory/1996-19-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/1996-21-0x0000000000330000-0x00000000003AE000-memory.dmp

Filesize
504KB

Download
memory/1996-26-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1996-31-0x0000000000470000-0x00000000004DB000-memory.dmp

Filesize
428KB

Download
memory/1996-54-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/2540-16-0x0000000022F90000-0x00000000231EC000-memory.dmp

Filesize
2.4MB

Download
memory/2540-3-0x0000000001660000-0x00000000016DE000-memory.dmp

Filesize
504KB

Download
memory/2540-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2540-15-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2540-0-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads