5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9

General

Target

5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
Size

525KB
MD5

f441f10a0ded7143652caff86ddc3f10
SHA1

d2b8221874fbd9e0c17459802c3e55cc5d923969
SHA256

5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9
SHA512

cebc254dc17f45e5718801e3d6876ecdb44ddfba0a902a3509f958a1ad2def58b1f5187238c445e9d805f249b20cc49cdf68cb09a74d1b4b776c5dc8bbe078e5
SSDEEP

12288:ogTcGuAhp9wooFHnkohmiQDZkUc6E0EmUNc//////n:ogTcGZtlo9nk4migtE0E1c//////n

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c0000000233d9-95.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1668	yypldgnsxhgj.exe

Loads dropped DLL 21 IoCs

pid	Process
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
1668	yypldgnsxhgj.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000002343f-88.dat	upx
behavioral2/memory/1668-90-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/files/0x000c0000000233d9-95.dat	upx
behavioral2/memory/1668-98-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-106-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-105-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-103-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-102-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-101-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1668-109-0x0000000000400000-0x00000000004F6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3132	1668	WerFault.exe	82
3000	1668	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yypldgnsxhgj.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1668	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	1668	yypldgnsxhgj.exe
Token: 33	1668	yypldgnsxhgj.exe
Token: SeIncBasePriorityPrivilege	1668	yypldgnsxhgj.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1668	yypldgnsxhgj.exe
1668	yypldgnsxhgj.exe
1668	yypldgnsxhgj.exe
1668	yypldgnsxhgj.exe
1668	yypldgnsxhgj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1668	3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	82
PID 3880 wrote to memory of 1668	3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	82
PID 3880 wrote to memory of 1668	3880	5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe	82

C:\Users\Admin\AppData\Local\Temp\5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe
"C:\Users\Admin\AppData\Local\Temp\5a33161fb68fcb82af490c4366f715f3469161ba38ecbaec610c8dee4dddcef9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe
  C:\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1016
    3⤵
    - Program crash
    PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1056
    3⤵
    - Program crash
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1668 -ip 1668
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1668 -ip 1668
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd8F50.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd8F50.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yypldgnsxhgj.exe

Filesize
428KB

MD5
f1938b9f1d282475c9e773e65500ab4e

SHA1
9682d5e5eb5b7330ec45d2b7e06def052753163b

SHA256
c8af39478971e08ab52d930f15e353fcd945d43a8c823bd0577305e5ff80f8d8

SHA512
0485aeee6e8e89e1f974c70736ebf44ae966e87b1433ce17e64016f1e9ace55c6c08a78cb3364027cfa7756bd6bb3ba85b55056b2a2dad1786045848cb54f972

Download Submit
memory/1668-100-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/1668-98-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-90-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1668-106-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-105-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-103-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-102-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-101-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1668-109-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download

Analysis

Sharing