0a95340a2e51ffa04336cb4ffa2600d2e84d0c8cd6dc1c84f55ecf5325f5ef0d

General

Target

HB_SpyEme06-30215_CZ.exe
Size

1.3MB
MD5

9a11fb5f544680c61a145c35b3b11d19
SHA1

812a226a67a9c703712c4f3defa72ee760b87546
SHA256

d237ba18b45f5e38e2cc46ed47d875abcf915a410165cafea6cd6677a1ba290d
SHA512

96c2aa96b5917af5f46c0b6356ffd37259e9c33085ca617481442f9a05bb46db35644e12537843ce6eb399a82d4ff2ca1f60864249379301a04b2bce0fb2ca9a
SSDEEP

24576:8R9j0EOKFR5PCFYiz2VsDSDyse2IA2s747irAj+QWxajW/hTF8emsH:m9tOiCF/z2V1yTAB74Gu+QWkjGTKk

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00050000000191f1-18.dat	acprotect

Loads dropped DLL 6 IoCs

pid	Process
2764	HB_SpyEme06-30215_CZ.exe
2764	HB_SpyEme06-30215_CZ.exe
2764	HB_SpyEme06-30215_CZ.exe
2764	HB_SpyEme06-30215_CZ.exe
2764	HB_SpyEme06-30215_CZ.exe
2764	HB_SpyEme06-30215_CZ.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000191f1-18.dat	upx
behavioral1/memory/2764-21-0x000000007C340000-0x000000007C39F000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcr71.dll	HB_SpyEme06-30215_CZ.exe
File opened for modification	C:\Windows\SysWOW64\msvcr71.dll	HB_SpyEme06-30215_CZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HB_SpyEme06-30215_CZ.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	HB_SpyEme06-30215_CZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	HB_SpyEme06-30215_CZ.exe

C:\Users\Admin\AppData\Local\Temp\HB_SpyEme06-30215_CZ.exe
"C:\Users\Admin\AppData\Local\Temp\HB_SpyEme06-30215_CZ.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7419.tmp\ioSpecial.ini

Filesize
910B

MD5
e211df3a1dc8e82634ac291d29e7daff

SHA1
5def1500c215816ada17f1c5fbb7ea72d376f217

SHA256
e3df3dcabd0f7d9306be2c99c1ab845f1d354001516fcb922853f30a48f25bcf

SHA512
2e45b06235d3a499eb5e9238e60aaeb508adfd9f84a6a210b69d6d32ba702169e3301bcf7a6c31fd12c175404c9340d237da15f36f1edffd0d041f3447fe1a5f

Download Submit
\Users\Admin\AppData\Local\Temp\NSISUtils\nsisutils.dll

Filesize
4KB

MD5
03a477dd69bd11877e2ac1953947c400

SHA1
e33881e8203674cc94bc9fcbde3e1f65ed4be5c7

SHA256
03c50276af73bb72b533f8936a57bbabe41e3b7d5e24cf60eb32f3b9df2cdd61

SHA512
c8d657199b7c2e2d3c9d76897426b1b9f227bd9d341481f059ab1ae6d79514e94620ec6434e32a6a07095350c90a80bfa46384cef12e309ba6f661d2ddac81af

Download Submit
\Users\Admin\AppData\Local\Temp\nst7419.tmp\bassmod.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
\Users\Admin\AppData\Local\Temp\nst7419.tmp\brandingurl.dll

Filesize
3KB

MD5
9c3488b5e9655d1837c3963ecec33f70

SHA1
f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

SHA256
05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

SHA512
6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

Download Submit
\Users\Admin\AppData\Local\Temp\nst7419.tmp\installoptions.dll

Filesize
12KB

MD5
cce5450725a9429a1d3c7aa851d40e8d

SHA1
05722500e42757ac03f2558452a064b906e31937

SHA256
d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

SHA512
3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

Download Submit
\Users\Admin\AppData\Local\Temp\nst7419.tmp\system.dll

Filesize
10KB

MD5
24a04541a0d2312e472f8236fd205ea8

SHA1
c47eeee6fc23590311f2860d80baa954386a8ce9

SHA256
74d7ac9e94305c3d30cfc19279ee73fa891bd5ae8800610dee391d1880825e19

SHA512
65e061d2776bc0db53ea8aa35fb50152818c74fa9735f1a5a370315c4dacaf2cb79374ec59174d86c2e87f5b0bb8662f8cee6ff97ae93261c9a9a05bd3cc1adf

Download Submit
\Windows\SysWOW64\msvcr71.dll

Filesize
162KB

MD5
79e4b72e99bbc1280141fd4ce7b2d8e1

SHA1
ecc213f0faae8a86a490f52d52b81f289948b491

SHA256
b92ab0e3a5ebfc0a8526dfbbca49d0df1c88e3ca688cf885ea2ab1974e0355db

SHA512
e2232c398e4833d9da2ab565a9fc70ee8ffa0bbc1ee1e867e7d4ad033bde3aef3c48e235eab26adaf8ae3afd556c536c7094cd3d885476cd893d69b0367db41b

Download Submit
memory/2764-113-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-121-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-11-0x0000000001D62000-0x0000000001D63000-memory.dmp

Filesize
4KB

Download
memory/2764-111-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-112-0x0000000001D62000-0x0000000001D63000-memory.dmp

Filesize
4KB

Download
memory/2764-10-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-115-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-117-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-119-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-21-0x000000007C340000-0x000000007C39F000-memory.dmp

Filesize
380KB

Download
memory/2764-123-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-125-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-127-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-129-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-131-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-133-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-135-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-137-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download
memory/2764-139-0x0000000001D50000-0x0000000001D63000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing