2c00460fb294b93f4d4675d47b3d6a9064fda1b23a2493181f7f9ae82c7fee80

General

Target

df98bf0787c847eda952aa050c47ec3d.exe
Size

33KB
MD5

df98bf0787c847eda952aa050c47ec3d
SHA1

671f6e5d1cfe96f35ae7f4139a26127e8f581654
SHA256

2c00460fb294b93f4d4675d47b3d6a9064fda1b23a2493181f7f9ae82c7fee80
SHA512

ce1535845114a6373fb759105bf0a1cb0f79f111ba76f06dc24ceece5dc115e0d803d59b81966a1866650f8c5eff26d783336871231118dc087bb2e0c739d2ff
SSDEEP

768:7kvk6dsQ08wOEFPRxOYU9AER1o4YNAq9fZY13sX52ynhBx9MW:7OWrrU7A4YNvG18XlL93

Score

8^/10

evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
2888	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2236-11-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yuksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\sysapp5.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\msimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\ksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\midimap.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	df98bf0787c847eda952aa050c47ec3d.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2304	sc.exe
2152	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2236	df98bf0787c847eda952aa050c47ec3d.exe
2236	df98bf0787c847eda952aa050c47ec3d.exe
2236	df98bf0787c847eda952aa050c47ec3d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	df98bf0787c847eda952aa050c47ec3d.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1508	2236	df98bf0787c847eda952aa050c47ec3d.exe	28
PID 2236 wrote to memory of 1508	2236	df98bf0787c847eda952aa050c47ec3d.exe	28
PID 2236 wrote to memory of 1508	2236	df98bf0787c847eda952aa050c47ec3d.exe	28
PID 2236 wrote to memory of 1508	2236	df98bf0787c847eda952aa050c47ec3d.exe	28
PID 2236 wrote to memory of 2152	2236	df98bf0787c847eda952aa050c47ec3d.exe	30
PID 2236 wrote to memory of 2152	2236	df98bf0787c847eda952aa050c47ec3d.exe	30
PID 2236 wrote to memory of 2152	2236	df98bf0787c847eda952aa050c47ec3d.exe	30
PID 2236 wrote to memory of 2152	2236	df98bf0787c847eda952aa050c47ec3d.exe	30
PID 2236 wrote to memory of 2304	2236	df98bf0787c847eda952aa050c47ec3d.exe	31
PID 2236 wrote to memory of 2304	2236	df98bf0787c847eda952aa050c47ec3d.exe	31
PID 2236 wrote to memory of 2304	2236	df98bf0787c847eda952aa050c47ec3d.exe	31
PID 2236 wrote to memory of 2304	2236	df98bf0787c847eda952aa050c47ec3d.exe	31
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 2236 wrote to memory of 2888	2236	df98bf0787c847eda952aa050c47ec3d.exe	33
PID 1508 wrote to memory of 2656	1508	net.exe	35
PID 1508 wrote to memory of 2656	1508	net.exe	35
PID 1508 wrote to memory of 2656	1508	net.exe	35
PID 1508 wrote to memory of 2656	1508	net.exe	35

C:\Users\Admin\AppData\Local\Temp\df98bf0787c847eda952aa050c47ec3d.exe
"C:\Users\Admin\AppData\Local\Temp\df98bf0787c847eda952aa050c47ec3d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    PID:2656
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2152
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1711470383.dat, ServerMain c:\users\admin\appdata\local\temp\df98bf0787c847eda952aa050c47ec3d.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1711470383.dat

Filesize
32KB

MD5
82eb180cbb7fe3697738f3a75748b2d1

SHA1
5b30dcd9ea6004ad83408e600cc9ebfd9b842dee

SHA256
db262e648084d9795bf516bafd02da866e1a5da69331b664f4d0226c8dff65ce

SHA512
b1a669456956535ad1006bc3093b286449da667b12cb91f7053d804e0387cbf871f026f7a656815122a194c5e93977db1774285dfb5057a16ceda165d1706b3a

Download Submit
memory/2236-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2236-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing