3f3dba748fdbf02d0b8eb7d91ac1d6290bb5deeb1aafff5ac0dd93fbee1a8a92

General

Target

be0b3ba988a20d55babdede4da4d4665.exe
Size

268KB
MD5

be0b3ba988a20d55babdede4da4d4665
SHA1

0012b6e57c3e25b24510d2e853700023886688f0
SHA256

3f3dba748fdbf02d0b8eb7d91ac1d6290bb5deeb1aafff5ac0dd93fbee1a8a92
SHA512

a94106a050baccab6fe282e0182d68494ad589703b6243983b4f82bb31f575041e827c8b3f36526e478c95b2563c5daef8d06908339beb98e4ae4b93b82d8cc9
SSDEEP

6144:YZg95gX629XfrhgkhX3EP+/LMdhX3EP+/LMwasL9TM9u:T9L29vP9TW9T/a8TAu

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	195b126e.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a000000012266-6.dat	aspack_v212_v242
behavioral1/files/0x0023000000018afc-17.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1296	195b126e.exe

Loads dropped DLL 2 IoCs

pid	Process
1296	195b126e.exe
2712	Svchost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000012266-6.dat	upx
behavioral1/memory/1296-10-0x0000000001280000-0x00000000012A4000-memory.dmp	upx
behavioral1/memory/1296-11-0x0000000001280000-0x00000000012A4000-memory.dmp	upx
behavioral1/memory/1296-9-0x0000000001280000-0x00000000012A4000-memory.dmp	upx
behavioral1/files/0x0023000000018afc-17.dat	upx
behavioral1/memory/2712-23-0x0000000075290000-0x00000000752B4000-memory.dmp	upx
behavioral1/memory/2712-25-0x0000000075290000-0x00000000752B4000-memory.dmp	upx
behavioral1/memory/2712-24-0x0000000075290000-0x00000000752B4000-memory.dmp	upx
behavioral1/memory/1296-27-0x0000000001280000-0x00000000012A4000-memory.dmp	upx
behavioral1/memory/2712-28-0x0000000075290000-0x00000000752B4000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\2B4C0568.tmp	195b126e.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	195b126e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1296	195b126e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1296	1984	be0b3ba988a20d55babdede4da4d4665.exe	28
PID 1984 wrote to memory of 1296	1984	be0b3ba988a20d55babdede4da4d4665.exe	28
PID 1984 wrote to memory of 1296	1984	be0b3ba988a20d55babdede4da4d4665.exe	28
PID 1984 wrote to memory of 1296	1984	be0b3ba988a20d55babdede4da4d4665.exe	28

C:\Users\Admin\AppData\Local\Temp\be0b3ba988a20d55babdede4da4d4665.exe
"C:\Users\Admin\AppData\Local\Temp\be0b3ba988a20d55babdede4da4d4665.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\195b126e.exe
  C:\195b126e.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1296

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\195b126e.exe

Filesize
82KB

MD5
7d4e2613f0ea47424abf94f243496b7c

SHA1
e5474beefd33d6960f3772cf609eccef6c8bf933

SHA256
da8a665255b95e94813868f1b951f866a98a4f0128588cdaf2230d3e0569e62a

SHA512
6c46217e1de0791c8ea0fb206e418c37e02091662623f114db470c0682736d07c6c68d5d83e1cd27296d2a4f52e93a9720f1e2402201ea3ba974180e27cff180

Download Submit
C:\Users\Infotmp.txt

Filesize
720B

MD5
f12c1f72583f46f4131449da23849acb

SHA1
0daec30867c1a2556ef582136d7c09a512ad1d56

SHA256
b7a774e0320fcf2dfeb8ed0b911e58e32f89836f19f3bbc30c7fd0a49ba58891

SHA512
04d83fc0c4f4c3d3e22885589ed649058b44a32c1c42095f04437f043db6f115e148bd13bef904407c3462f2a89e2aba8c1e4ef1a9bd7119b5b0b678aa9f8045

Download Submit
\Windows\SysWOW64\2B4C0568.tmp

Filesize
82KB

MD5
84861b96544320087874cb18dbc80c32

SHA1
21ae60daa169622a8ed17a9d01beeb59c1d0ad23

SHA256
9d3c39542acf561ff67e849c3e0082ee465ed73e16f67ec5a3578938a3a21008

SHA512
48408df3a4340d99458be38e8f9f9b73d5fa4b932cf5114c595f347e4bd682d77c5a1fe1ba203dae80417f1a4dfc288da30be2f49d275e7d8efcd55ee1caf63c

Download Submit
memory/1296-16-0x0000000076C40000-0x0000000076CA0000-memory.dmp

Filesize
384KB

Download
memory/1296-19-0x0000000075290000-0x00000000752B4000-memory.dmp

Filesize
144KB

Download
memory/1296-11-0x0000000001280000-0x00000000012A4000-memory.dmp

Filesize
144KB

Download
memory/1296-9-0x0000000001280000-0x00000000012A4000-memory.dmp

Filesize
144KB

Download
memory/1296-15-0x0000000077DBF000-0x0000000077DC0000-memory.dmp

Filesize
4KB

Download
memory/1296-29-0x0000000076C40000-0x0000000076CA0000-memory.dmp

Filesize
384KB

Download
memory/1296-27-0x0000000001280000-0x00000000012A4000-memory.dmp

Filesize
144KB

Download
memory/1296-10-0x0000000001280000-0x00000000012A4000-memory.dmp

Filesize
144KB

Download
memory/1984-3-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/1984-7-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/1984-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1984-30-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2712-23-0x0000000075290000-0x00000000752B4000-memory.dmp

Filesize
144KB

Download
memory/2712-25-0x0000000075290000-0x00000000752B4000-memory.dmp

Filesize
144KB

Download
memory/2712-24-0x0000000075290000-0x00000000752B4000-memory.dmp

Filesize
144KB

Download
memory/2712-28-0x0000000075290000-0x00000000752B4000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads