5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9

General

Target

5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
Size

525KB
MD5

f441f10a0ded7143652caff86ddc3f10
SHA1

d2b8221874fbd9e0c17459802c3e55cc5d923969
SHA256

5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9
SHA512

cebc254dc17f45e5718801e3d6876ecdb44ddfba0a902a3509f958a1ad2def58b1f5187238c445e9d805f249b20cc49cdf68cb09a74d1b4b776c5dc8bbe078e5
SSDEEP

12288:ogTcGuAhp9wooFHnkohmiQDZkUc6E0EmUNc//////n:ogTcGZtlo9nk4migtE0E1c//////n

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x002c000000018671-105.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
656	yypldgnsxhgj.exe

Loads dropped DLL 26 IoCs

pid	Process
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000186b7-83.dat	upx
behavioral1/memory/2700-93-0x00000000028C0000-0x00000000029B6000-memory.dmp	upx
behavioral1/files/0x002c000000018671-105.dat	upx
behavioral1/memory/656-107-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/656-130-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/656-131-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/656-133-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/656-146-0x0000000000400000-0x00000000004F6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yypldgnsxhgj.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	yypldgnsxhgj.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
656	yypldgnsxhgj.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	656	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	656	yypldgnsxhgj.exe
Token: 33	656	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	656	yypldgnsxhgj.exe
Token: 33	656	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	656	yypldgnsxhgj.exe
Token: 33	656	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	656	yypldgnsxhgj.exe
Token: 33	656	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	656	yypldgnsxhgj.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe
656	yypldgnsxhgj.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31
PID 2700 wrote to memory of 656	2700	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	31

C:\Users\Admin\AppData\Local\Temp\5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
"C:\Users\Admin\AppData\Local\Temp\5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe
  C:\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
\Users\Admin\AppData\Local\Temp\nse3EA7.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit
\Users\Admin\AppData\Local\Temp\nse3EA7.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe

Filesize
428KB

MD5
f1938b9f1d282475c9e773e65500ab4e

SHA1
9682d5e5eb5b7330ec45d2b7e06def052753163b

SHA256
c8af39478971e08ab52d930f15e353fcd945d43a8c823bd0577305e5ff80f8d8

SHA512
0485aeee6e8e89e1f974c70736ebf44ae966e87b1433ce17e64016f1e9ace55c6c08a78cb3364027cfa7756bd6bb3ba85b55056b2a2dad1786045848cb54f972

Download Submit
memory/656-100-0x0000000000500000-0x00000000005F6000-memory.dmp

Filesize
984KB

Download
memory/656-107-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/656-130-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/656-131-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/656-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/656-146-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2700-94-0x00000000028C0000-0x00000000029B6000-memory.dmp

Filesize
984KB

Download
memory/2700-93-0x00000000028C0000-0x00000000029B6000-memory.dmp

Filesize
984KB

Download

Analysis

Sharing