dea305a2883587249f4b84477bbb8ee6b451c05624d7a3e2a9fed8c3bc05bb1a

General

Target

d713f2dc371b78cb8b8cbeef8763d447.dll
Size

316KB
MD5

d713f2dc371b78cb8b8cbeef8763d447
SHA1

39a758ebf768d0dc94931760ea020710198749f9
SHA256

dea305a2883587249f4b84477bbb8ee6b451c05624d7a3e2a9fed8c3bc05bb1a
SHA512

ba3382159ff2e63045fe08af663d06614ab54818c354b027bfb2aff64e6b4261bdbfd30bec226104c43f2d90bace33c3c4fb5ef23bdde1dc001f0c517166a66d
SSDEEP

6144:WmQw913yl0p7ZViRQUsi8BGCEDG3RW1MqJDQm:Wmb13bFZanTmE6WPDj

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000023386-4.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
1036	RKTD.EXE
2924	InstaFinder_inst.exe
4540	MegasearchBarSetup.exe
3636	LMU.exe

Loads dropped DLL 2 IoCs

pid	Process
2924	InstaFinder_inst.exe
4540	MegasearchBarSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lmu = "C:\\Windows\\LMU.exe"	LMU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RKTD.EXE	regsvr32.exe
File created	C:\Windows\SysWOW64\InstaFinder_inst.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\MegasearchBarSetup.exe	regsvr32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\LMU.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\ = "exe_in_dll 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d713f2dc371b78cb8b8cbeef8763d447.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0\win32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1036	RKTD.EXE
1036	RKTD.EXE
1036	RKTD.EXE
1036	RKTD.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2760	1428	regsvr32.exe	86
PID 1428 wrote to memory of 2760	1428	regsvr32.exe	86
PID 1428 wrote to memory of 2760	1428	regsvr32.exe	86
PID 2760 wrote to memory of 1036	2760	regsvr32.exe	87
PID 2760 wrote to memory of 1036	2760	regsvr32.exe	87
PID 2760 wrote to memory of 1036	2760	regsvr32.exe	87
PID 2760 wrote to memory of 2924	2760	regsvr32.exe	88
PID 2760 wrote to memory of 2924	2760	regsvr32.exe	88
PID 2760 wrote to memory of 2924	2760	regsvr32.exe	88
PID 2760 wrote to memory of 4540	2760	regsvr32.exe	89
PID 2760 wrote to memory of 4540	2760	regsvr32.exe	89
PID 2760 wrote to memory of 4540	2760	regsvr32.exe	89
PID 2760 wrote to memory of 3636	2760	regsvr32.exe	90
PID 2760 wrote to memory of 3636	2760	regsvr32.exe	90
PID 2760 wrote to memory of 3636	2760	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d713f2dc371b78cb8b8cbeef8763d447.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d713f2dc371b78cb8b8cbeef8763d447.dll
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\RKTD.EXE
    "C:\Windows\System32\RKTD.EXE" /partnerData 5,3
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- - C:\Windows\SysWOW64\InstaFinder_inst.exe
    "C:\Windows\System32\InstaFinder_inst.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2924
- - C:\Windows\SysWOW64\MegasearchBarSetup.exe
    "C:\Windows\System32\MegasearchBarSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4540
- - C:\Windows\LMU.exe
    "C:\Windows\LMU.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy8FCE.tmp\nsisdl.dll

Filesize
12KB

MD5
e4145a76f37b199c3cb9ab8d23c3c1d6

SHA1
b6beecaaf0f29d02f293e07954ebd7f7df25160b

SHA256
ab657405df2b4d86793a4959a7c8c86ffbcc732733bc884f001fcb1219e68a9d

SHA512
9fe0796a76998b80c2d34825ba0256147cb8104bf2b39fa3d8642ab8a7ef99cf2fd9715bb73661b4e42c47125a22d96e1e85abb88018bfc97548823f7a254b06

Download Submit
C:\Windows\LMU.exe

Filesize
148KB

MD5
9ffb14082685fd5d0613d6f032eba8c5

SHA1
2bcef98931aea3f7ed08b71357e422d3b2c1d418

SHA256
bc422d91a6a33e5e0922815a966bdf61eecbda30b5425e520add961d92f766ba

SHA512
36189f6a75a5592d0aab5dd851bb36550e4eb516da2c4bc7083cc2cf868a96478d0d7a816e34a67644f3fa067dc403e1e08853ca2a213c2a9bddfbcc74004ed0

Download Submit
C:\Windows\SysWOW64\InstaFinder_inst.exe

Filesize
39KB

MD5
78c117a88faa84e13731fbb51cb3be5a

SHA1
bed96019b1c8a590d016e239b6fedc91fd989027

SHA256
6903173bc6073546a3c7b39600041f2041f026bae6f4ee8db6f94d2c1a1ff22e

SHA512
97e34832969998eef5c05d8fabbd5c9e143605826a5927d38c27d604ef3cd2dd87eeb1db9653fe2dd61903f3a468a9817c9ce33c3238f95643b623d964596c6d

Download Submit
C:\Windows\SysWOW64\MegasearchBarSetup.exe

Filesize
39KB

MD5
2ba45ac0d19297950d4fa1b8acc56800

SHA1
92e35d569edf5fca6ec5eee1b1e874c5157215b9

SHA256
c261285295845b6bab774a0c854fa0ec895df9b5c76dbc6cf514e92223f221dd

SHA512
5352d7e755a4eec50dbc699f0b2b9f41b86972beeb6d6c980855c66a6da861f166d301a618176295f608a1e77e1c7047213b6c232bbfd61653beb18830125319

Download Submit
C:\Windows\SysWOW64\RKTD.EXE

Filesize
68KB

MD5
699cacb599b7c9f605bf5f9acb8dc161

SHA1
c69321a457705d50f17abd2180a5ea6325b23103

SHA256
40177011d48adb12b3ddaa18dc6e4d0f3a5c21ecbc7d454bc7c66b990270a1d6

SHA512
cb33eeb934a43009b62f08cc3c42d742adf9d1e34890e04135a4a4502c771b25d446380bd794b7c1dc4dc36a857cec343d95c3f819f7d77dc134cad880499ed0

Download Submit
memory/1036-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1036-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads