Overview
overview
7Static
static
78fecd0dd91...26.exe
windows7-x64
78fecd0dd91...26.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3FineTop.dll
windows7-x64
6FineTop.dll
windows10-2004-x64
6FineTop.exe
windows7-x64
6FineTop.exe
windows10-2004-x64
6adc.dll
windows7-x64
1adc.dll
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 19:08
Behavioral task
behavioral1
Sample
8fecd0dd91d9d0811d67e18db275c126.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8fecd0dd91d9d0811d67e18db275c126.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
FineTop.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
FineTop.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
FineTop.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
FineTop.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
adc.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
adc.dll
Resource
win10v2004-20231222-en
General
-
Target
8fecd0dd91d9d0811d67e18db275c126.exe
-
Size
282KB
-
MD5
8fecd0dd91d9d0811d67e18db275c126
-
SHA1
58e3bb4c421d10bea8855cfd521da25e3aaa2779
-
SHA256
89377e06e411db8fa2e76c586b549099c339d3d4ed6f4bc3b14888204c50a373
-
SHA512
77e32aeece8b4c222a4a6d80412819da6f766a1758c444e4dd9448d7c4b2170ce46770fc7bc6c3a6747862573ca1324850b5e430e877170c0d5828ea44fb6643
-
SSDEEP
6144:ee34L675+ZPPfnE2Qyn20UA5ibYMYC/gMXG6lCHBL75+ZPPfnE2Qyn20U:G6F+ZPPfnEUnhwMhLF+ZPPfnEUn
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023218-66.dat acprotect behavioral2/memory/4012-69-0x0000000073560000-0x0000000073569000-memory.dmp acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 8fecd0dd91d9d0811d67e18db275c126.exe -
Deletes itself 1 IoCs
pid Process 3840 explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 3608 FineTop.exe -
Loads dropped DLL 15 IoCs
pid Process 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4216 regsvr32.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 3608 FineTop.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 2200 regsvr32.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe -
resource yara_rule behavioral2/files/0x0007000000023218-66.dat upx behavioral2/memory/4012-69-0x0000000073560000-0x0000000073569000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FineTop = "C:\\Program Files (x86)\\FineTop\\FineTop.exe" FineTop.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4012 set thread context of 3840 4012 8fecd0dd91d9d0811d67e18db275c126.exe 94 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\FineTop\Uninstall.exe 8fecd0dd91d9d0811d67e18db275c126.exe File created C:\Program Files (x86)\FineTop\FineTop.dll 8fecd0dd91d9d0811d67e18db275c126.exe File created C:\Program Files (x86)\FineTop\FineTop.exe 8fecd0dd91d9d0811d67e18db275c126.exe File created C:\Program Files (x86)\FineTop\adc.acc 8fecd0dd91d9d0811d67e18db275c126.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CurVer\ = "FineTop.TopBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\ = "TopBand Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID\ = "FineTop.TopBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID\ = "FineTop.TopBand" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\FineTop\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ = "FineTop" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID\ = "FineTop.TopBand" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\ = "TopBand Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ = "ITopBand" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\ = "TopBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\0\win32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\ = "TopBand Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CurVer\ = "FineTop.TopBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\ = "FineTop 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\HELPDIR regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe 4012 8fecd0dd91d9d0811d67e18db275c126.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe 3608 FineTop.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4012 wrote to memory of 1112 4012 8fecd0dd91d9d0811d67e18db275c126.exe 84 PID 4012 wrote to memory of 1112 4012 8fecd0dd91d9d0811d67e18db275c126.exe 84 PID 4012 wrote to memory of 1112 4012 8fecd0dd91d9d0811d67e18db275c126.exe 84 PID 4012 wrote to memory of 2748 4012 8fecd0dd91d9d0811d67e18db275c126.exe 85 PID 4012 wrote to memory of 2748 4012 8fecd0dd91d9d0811d67e18db275c126.exe 85 PID 4012 wrote to memory of 2748 4012 8fecd0dd91d9d0811d67e18db275c126.exe 85 PID 4012 wrote to memory of 3632 4012 8fecd0dd91d9d0811d67e18db275c126.exe 86 PID 4012 wrote to memory of 3632 4012 8fecd0dd91d9d0811d67e18db275c126.exe 86 PID 4012 wrote to memory of 3632 4012 8fecd0dd91d9d0811d67e18db275c126.exe 86 PID 4012 wrote to memory of 404 4012 8fecd0dd91d9d0811d67e18db275c126.exe 87 PID 4012 wrote to memory of 404 4012 8fecd0dd91d9d0811d67e18db275c126.exe 87 PID 4012 wrote to memory of 404 4012 8fecd0dd91d9d0811d67e18db275c126.exe 87 PID 4012 wrote to memory of 3600 4012 8fecd0dd91d9d0811d67e18db275c126.exe 88 PID 4012 wrote to memory of 3600 4012 8fecd0dd91d9d0811d67e18db275c126.exe 88 PID 4012 wrote to memory of 3600 4012 8fecd0dd91d9d0811d67e18db275c126.exe 88 PID 4012 wrote to memory of 556 4012 8fecd0dd91d9d0811d67e18db275c126.exe 89 PID 4012 wrote to memory of 556 4012 8fecd0dd91d9d0811d67e18db275c126.exe 89 PID 4012 wrote to memory of 556 4012 8fecd0dd91d9d0811d67e18db275c126.exe 89 PID 4012 wrote to memory of 4216 4012 8fecd0dd91d9d0811d67e18db275c126.exe 90 PID 4012 wrote to memory of 4216 4012 8fecd0dd91d9d0811d67e18db275c126.exe 90 PID 4012 wrote to memory of 4216 4012 8fecd0dd91d9d0811d67e18db275c126.exe 90 PID 4012 wrote to memory of 3608 4012 8fecd0dd91d9d0811d67e18db275c126.exe 91 PID 4012 wrote to memory of 3608 4012 8fecd0dd91d9d0811d67e18db275c126.exe 91 PID 4012 wrote to memory of 3608 4012 8fecd0dd91d9d0811d67e18db275c126.exe 91 PID 3608 wrote to memory of 2200 3608 FineTop.exe 93 PID 3608 wrote to memory of 2200 3608 FineTop.exe 93 PID 3608 wrote to memory of 2200 3608 FineTop.exe 93 PID 4012 wrote to memory of 3840 4012 8fecd0dd91d9d0811d67e18db275c126.exe 94 PID 4012 wrote to memory of 3840 4012 8fecd0dd91d9d0811d67e18db275c126.exe 94 PID 4012 wrote to memory of 3840 4012 8fecd0dd91d9d0811d67e18db275c126.exe 94 PID 4012 wrote to memory of 3840 4012 8fecd0dd91d9d0811d67e18db275c126.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fecd0dd91d9d0811d67e18db275c126.exe"C:\Users\Admin\AppData\Local\Temp\8fecd0dd91d9d0811d67e18db275c126.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\InfoTab\InfoTab.dll"2⤵PID:1112
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\PlusTab\PlusTab.dll"2⤵PID:2748
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\SmartTool\SmartTool.dll"2⤵PID:3632
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\TopGuide\TopGuide.dll"2⤵PID:404
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\InfoWise\InfoWise.dll"2⤵PID:3600
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\WiseBar\WiseBar.dll"2⤵PID:556
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\FineTop\FineTop.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4216
-
-
C:\Program Files (x86)\FineTop\FineTop.exe"C:\Program Files (x86)\FineTop\FineTop.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\FineTop\FineTop.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2200
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe2⤵
- Deletes itself
PID:3840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD582a6904974f4f20c147fce776663b1b0
SHA1eee8e0a93cb1be3dcfef2699f154f0881e68dda4
SHA256407a5ed628dbd6f1c2cea2276b4ea98f053160dd6f5ee3007dcbad02382a1a77
SHA51250dfb3c8e67e1ef794f3dd1b4caaa515bfe342e17e4bb73dd2b1e58a2ac61e327bed2395c1f36d8f2a69de8c5a73ce03eda03a9c0c5515b5965191edfb22c005
-
Filesize
42KB
MD561c81941b91b1d502971bd42a29806a1
SHA172ee7b2fb665f01415a00267cbc1a5d385d1f0cf
SHA2566e0d4e65b147d69b249c40c1f9cc5ea82ae3179777bd25462eef3449d3bbbdb8
SHA5120583df8495ed3c252713bfa2b0b38b9a2aac8ce22ed5e50e42cf5a7d94e903e605614a5ab507a0b10497f434759c945eec7ae1f124f530fe3d488f4ec661de7f
-
Filesize
28KB
MD572b966950a0f53df4ce2fdb19679c3c6
SHA1ccfff4ecc68608a6231e75e175d2aeba62d37fa5
SHA256aa3c21a88e93709f149284cc17a37439d3f7f90b785119fee5ef330902718b65
SHA51284149a210748bc45f02d7f5e12b37e91eba44500d7222efaa46228b1330ffe0dfc1efbb612a67a562ddffc3048ba5d67426b739ac950e8da27f0ee9e86707e33
-
Filesize
114KB
MD5a3ed6f7ea493b9644125d494fbf9a1e6
SHA1ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA256ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
SHA5127099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
4KB
MD57cff7fe2caea5184d98c147e7e263132
SHA121f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA256281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
SHA512fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
-
Filesize
13KB
MD529858669d7da388d1e62b4fd5337af12
SHA1756b94898429a9025a04ae227f060952f1149a5f
SHA256c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
SHA5126f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b