54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb

General

Target

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe
Size

1.7MB
MD5

5133f122f65287d8a79e9a1cd3fad3cb
SHA1

a0ad13d1f74d20d24130dea2400781fa5d427168
SHA256

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb
SHA512

f75f0627bacd6d06a30b0d1b79103238c7f46fbc3bf9f2126516a0d27095c69ca5527fcbc637e7ab8ca05959ba6318fd37103f045784bfedc171c724a5f5e523
SSDEEP

24576:F+SFQyRru2P6TW+/OMiFhTCRQwG6F5/xsSSBl76xPbdHURIcNTKarBI:BZubTWLb33s/xkl76FZUKaKarB

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
C:\Windows\tODNDb\GuLGfqmR.dll	UPX
behavioral2/memory/4336-55-0x0000000074390000-0x0000000074419000-memory.dmp	UPX

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CC7wuJ7lYG\ImagePath = "\\??\\C:\\Windows\\CC7wuJ7lYGI.sys"	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\tODNDb\GuLGfqmR.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

pid process

4336 54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Loads dropped DLL 3 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

pid	process
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\tODNDb\GuLGfqmR.dll	upx
behavioral2/memory/4336-55-0x0000000074390000-0x0000000074419000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\cLHPeOG\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe
File created	C:\Windows\SysWOW64\cLHPeOG\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe

Drops file in Windows directory 11 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe

description	ioc	process
File created	C:\Windows\EPQFrh.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\tODNDb\yoUXmLGe.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File opened for modification	C:\Windows\tODNDb\yoUXmLGe.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\CC7wuJ7lYGI.sys	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\fHwDMD.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe
File created	C:\Windows\tODNDb\KBAUbmBR.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\24.txt	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\tODNDb\FgGfpTHCK.tmp	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File opened for modification	C:\Windows\24.txt	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\tODNDb\GuLGfqmR.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
File created	C:\Windows\tODNDb\TdmsGAioH.dll	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

pid	process
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

pid process

4336 54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

description	pid	process
Token: SeDebugPrivilege	4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Token: SeLoadDriverPrivilege	4336	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe

description	pid	process	target process
PID 3016 wrote to memory of 4336	3016	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
PID 3016 wrote to memory of 4336	3016	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
PID 3016 wrote to memory of 4336	3016	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe	54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe

C:\Users\Admin\AppData\Local\Temp\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe
"C:\Users\Admin\AppData\Local\Temp\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0adc2713ef35eb.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\cLHPeOG\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
"C:\Windows\SysWOW64\cLHPeOG\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe"
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\cLHPeOG\54a784d19e501af0244c8ce692563cc0234952f8c59345968b0dc2713ef35eb.exe
Filesize
1.7MB

MD5
9a89ba6a05de739650522f52e5111e7e

SHA1
339dd143ddab72677c5bfdfe26c56fa76167ee60

SHA256
a7fbeecc6185d74418889da5c51eee6cb75c5368d15951f7748dc006aad16706

SHA512
87210f08c5acd45edaca41fe274b22a17d08f0ae310abc151bf8d8d9b5e1fd9dec16dedf79e21b1e266da7a80b31d4cb4db6d0c3f3d19ccd9097e9ba1b398579

Download Submit
C:\Windows\tODNDb\GuLGfqmR.dll
Filesize
483KB

MD5
88c4820aa1ecfa3017963db6a60952a0

SHA1
95aeaa84e38c62059a703c6a8ce8712df9c990f9

SHA256
bb3c682d5bbe59a63dd8fad19466f8c9f770df15acdbed580012be7cea62acbd

SHA512
bde8c85f4232f24f415289e1aab61ce090cbd06442d774908a86ede135e74834e4c964c1a584df7a8d37fb56559126de24ff42c8497df7602534cb5d6100f5ee

Download Submit
C:\Windows\tODNDb\KBAUbmBR.dll
Filesize
867KB

MD5
348a9d2581e02d891f1da521dd37b0ab

SHA1
87c1df73a884fea3d8a6b60945816bd91207dd24

SHA256
51d4c4d3d0b9add5a25f5a6818c66882f97449d5263588ce2163864c80c98d36

SHA512
2e275f396dd495bb904d25789a917725ce4038853f8631099f3058b0dd623dfd097cae2105f5b9844bfa6a11dc08aede81c440d337a75ad926aae632be31b768

Download Submit
memory/3016-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/3016-9-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4336-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4336-12-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4336-27-0x0000000002EA0000-0x0000000003028000-memory.dmp

Filesize
1.5MB

Download
memory/4336-28-0x0000000002C10000-0x0000000002C13000-memory.dmp

Filesize
12KB

Download
memory/4336-33-0x0000000002EA0000-0x0000000003028000-memory.dmp

Filesize
1.5MB

Download
memory/4336-55-0x0000000074390000-0x0000000074419000-memory.dmp

Filesize
548KB

Download
memory/4336-54-0x0000000002C10000-0x0000000002C13000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads