9af29ab586c332282df764999daf6166e3c6676d22ede5afab11294a5ccb3a91

General

Target

d88384b40665edeedbad3f1bed2a8de0N.exe
Size

612KB
MD5

d88384b40665edeedbad3f1bed2a8de0
SHA1

d46bc5b9e8598033a440569bf48bc6525837e477
SHA256

9af29ab586c332282df764999daf6166e3c6676d22ede5afab11294a5ccb3a91
SHA512

7cd74eb362adfcc7d209a369c43cca367e7fee62b8f076549806089c33ed50e089c62fb53c02c82ed46db3954b90d87861a741b2ecfc7c42b95cce2eddfcb661
SSDEEP

12288:TGtAtScw3qEKBSGtAtScw3qEKBSGtAtScw3qEKB:814511451145

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2348	OBQPA.EXE

Loads dropped DLL 2 IoCs

pid	Process
1820	d88384b40665edeedbad3f1bed2a8de0N.exe
1820	d88384b40665edeedbad3f1bed2a8de0N.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	OBQPA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\BPWOE.EXE \"%1\" %*"	OBQPA.EXE

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1820-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x0008000000016210-10.dat	upx
behavioral1/files/0x0007000000012118-20.dat	upx
behavioral1/memory/2348-29-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1820-32-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-33-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-34-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-40-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-41-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-42-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-43-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-44-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-46-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-47-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-48-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2348-49-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VOBSU.EXE = "C:\\Program Files (x86)\\VOBSU.EXE"	d88384b40665edeedbad3f1bed2a8de0N.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\L:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\M:	OBQPA.EXE
File opened (read-only)	\??\O:	OBQPA.EXE
File opened (read-only)	\??\T:	OBQPA.EXE
File opened (read-only)	\??\U:	OBQPA.EXE
File opened (read-only)	\??\E:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\H:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\V:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\N:	OBQPA.EXE
File opened (read-only)	\??\V:	OBQPA.EXE
File opened (read-only)	\??\I:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\R:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\S:	OBQPA.EXE
File opened (read-only)	\??\J:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\H:	OBQPA.EXE
File opened (read-only)	\??\P:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\U:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\I:	OBQPA.EXE
File opened (read-only)	\??\Q:	OBQPA.EXE
File opened (read-only)	\??\R:	OBQPA.EXE
File opened (read-only)	\??\M:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\O:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\K:	OBQPA.EXE
File opened (read-only)	\??\Q:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\J:	OBQPA.EXE
File opened (read-only)	\??\S:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\E:	OBQPA.EXE
File opened (read-only)	\??\L:	OBQPA.EXE
File opened (read-only)	\??\P:	OBQPA.EXE
File opened (read-only)	\??\N:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\G:	OBQPA.EXE
File opened (read-only)	\??\G:	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened (read-only)	\??\T:	d88384b40665edeedbad3f1bed2a8de0N.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OBQPA.EXE	d88384b40665edeedbad3f1bed2a8de0N.exe
File opened for modification	C:\Program Files (x86)\OBQPA.EXE	d88384b40665edeedbad3f1bed2a8de0N.exe
File created	C:\Program Files (x86)\VOBSU.EXE	d88384b40665edeedbad3f1bed2a8de0N.exe
File created	C:\Program Files (x86)\BPWOE.EXE	OBQPA.EXE

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OBQPA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d88384b40665edeedbad3f1bed2a8de0N.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\$Recycle.Bin\\OCY.EXE \"%1\" %*"	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	OBQPA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\BPWOE.EXE \"%1\" %*"	OBQPA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\$Recycle.Bin\\OCY.EXE %1"	d88384b40665edeedbad3f1bed2a8de0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\$Recycle.Bin\\OCY.EXE %1"	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	d88384b40665edeedbad3f1bed2a8de0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\$Recycle.Bin\\OCY.EXE %1"	d88384b40665edeedbad3f1bed2a8de0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	d88384b40665edeedbad3f1bed2a8de0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\$Recycle.Bin\\OCY.EXE \"%1\""	d88384b40665edeedbad3f1bed2a8de0N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	OBQPA.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2348	1820	d88384b40665edeedbad3f1bed2a8de0N.exe	30
PID 1820 wrote to memory of 2348	1820	d88384b40665edeedbad3f1bed2a8de0N.exe	30
PID 1820 wrote to memory of 2348	1820	d88384b40665edeedbad3f1bed2a8de0N.exe	30
PID 1820 wrote to memory of 2348	1820	d88384b40665edeedbad3f1bed2a8de0N.exe	30

C:\Users\Admin\AppData\Local\Temp\d88384b40665edeedbad3f1bed2a8de0N.exe
"C:\Users\Admin\AppData\Local\Temp\d88384b40665edeedbad3f1bed2a8de0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\OBQPA.EXE
  "C:\Program Files (x86)\OBQPA.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\OCY.EXE

Filesize
612KB

MD5
44130dc722398e32747b236db036b08f

SHA1
588b54094790e7a307f01ee78b474ba7a605c527

SHA256
d265d761906fdd6294dbc406f31f5335b66383a73ea6c3f8e0a38981515d43c6

SHA512
e86e2768a5b0efea2249430bc009ee0566b253bddff87e40e016dac73d7a91d2ba7712457a34d2d97b0eeda0a009e4357aadf54c1394d051c90f1233db63afb7

Download Submit
C:\filedebug

Filesize
252B

MD5
751238394924c278b2399d3ff813fa2b

SHA1
212255ae4da4cb33522baea7d67dfaadf0f5344d

SHA256
0de9d80eb7f513c8b6be59bd4e85468bbb074d8bab4f46608d476e7b6faf302e

SHA512
5b04d2e028ed74dccb6a9e20e364c14e245c64dfd642c3072de298b2cda1cc8e64d5bb937713943b5b416c2e55055cb9dd75951748b79a8f888e8b615a64eb08

Download Submit
\??\c:\filedebug

Filesize
286B

MD5
f369cfe4fa440dc27eb0fcf9a9db3b42

SHA1
4b8a3acf35493c79d662cb9cf6842fd608c91854

SHA256
4799afa3275645959d0a0d93aa19e7c1dbdb0cd7655ef36865a64d8ee269da35

SHA512
c4db0608eaca941e39367faeb3baa90766953208c985f44a1f0e8389191715439d66e0c3521a50354c7d7aca682882a0e24e790c4a1ac19e85bd277032ae800c

Download Submit
\Program Files (x86)\OBQPA.EXE

Filesize
613KB

MD5
16f7fa5528fe4a0b58c8ee8da13b5703

SHA1
a3b5da80b80855e1b87645efa9262acb81c1f767

SHA256
843d39758f3ddb73ea29d22eed16a0c8c147feb96778b181bc96cf9c1be5407c

SHA512
0f9630de20e2a1ab68cec6c1576e4b4b58b1f0718850079ddb2faa095b328867f7d007d354881a59cf50b2f928c16e82cb864c31c6e25a66e5da3908d2211d85

Download Submit
memory/1820-32-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1820-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1820-28-0x0000000002020000-0x000000000208E000-memory.dmp

Filesize
440KB

Download
memory/1820-27-0x0000000002020000-0x000000000208E000-memory.dmp

Filesize
440KB

Download
memory/1820-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-33-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-42-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-35-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2348-34-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-29-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-40-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-41-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-30-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2348-43-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-44-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-46-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-47-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-48-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2348-49-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads