8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c

General

Target

8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe
Size

33KB
MD5

4b1274045c8b798fb5ae48ed787b91bc
SHA1

c4e0c9539078cabc631e58c2d5dbc23c575ae881
SHA256

8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c
SHA512

bb15b4aeefd9b9966821ead8512635cf3261152c90578b50a958cda7157cb7692640f23346eea9a32f03e3c79a84e581a9a64895250a665c2e5bbdced2e8f6a3
SSDEEP

768:hXb14aEF5lJnbcuyD7Uu79d/0V5uj+vQ9VniSF56L5i:Jb143vvnouy8CsV53ciSFEE

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000023c7c-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3828	regsvr32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3732-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0009000000023c7c-4.dat	upx
behavioral2/memory/3828-6-0x00000000701A0000-0x00000000701AB000-memory.dmp	upx
behavioral2/memory/3828-8-0x00000000701A0000-0x00000000701AB000-memory.dmp	upx
behavioral2/memory/3732-10-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O950694.dll	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O950694.dll	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d95-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32\Original = "C:\\Windows\\SysWOW64\\urlmon.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d95-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DA0O950694.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32\Original = "C:\\Windows\\SysWOW64\\Dxtrans.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DA0O950694.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEFFD4A5-FC5D-4427-920D-E4917AAD09EE}	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3828	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3732	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3828	3732	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe	84
PID 3732 wrote to memory of 3828	3732	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe	84
PID 3732 wrote to memory of 3828	3732	8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe	84

C:\Users\Admin\AppData\Local\Temp\8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe
"C:\Users\Admin\AppData\Local\Temp\8cbed0ee0862e31d2d422545938c361e5ade5e9d3f64c3c3f61fa6a6bc8fa75c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /n /s /i:"-f 7b8a2d95-0ac9-11d1-896c-00c04Fb6bfc4 -f D1FE6762-FC48-11D0-883A-3C8B00C10000" "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O950694.dll"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O950694.dll

Filesize
15KB

MD5
eb7562c051aa3febe68d7386dc699613

SHA1
c45808dcbe0955cbb024f8d020be36ab50139fc4

SHA256
2135f272cae39c084208d3d306b539eb769b63d24b10d9a2f32e0447c6e9fd3c

SHA512
cd0a7042a17c1f02b6a29cc4a8fc4022cb70b4086f417e88ad7e7c6d8f9ff42464b058876fb2a3e83f25c8214ff828c47b585fe5ca538c599a6bacbee98260b6

Download Submit
memory/3732-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3732-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3828-6-0x00000000701A0000-0x00000000701AB000-memory.dmp

Filesize
44KB

Download
memory/3828-8-0x00000000701A0000-0x00000000701AB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing