05266a1e82541f3908c2acdb6596791f842c4f483546e89cd52c22bb67a3f0f5

General

Target

AQUA PREMIUM (1).rar
Size

5.8MB
MD5

f71e4dec9ba49a0996f577257ec31ed8
SHA1

55c9af15d1c9e55f8966d819a623b225fd06f5cc
SHA256

05266a1e82541f3908c2acdb6596791f842c4f483546e89cd52c22bb67a3f0f5
SHA512

113ff3f29821ea93c71dd32854714caf8efec9ea6f6e78f39254f44358bf6cfab40984d6c72e4951156c03233bbac0a6de748e94459d3ac5ddc91cbb875c9ec7
SSDEEP

98304:WoJ7oTgg90I9kbDh3D6cRxeqmN06/JGq46iZ1XNSNxCIH8GYwCudG8pUT0u/:Wopozd9ADpDWNeAJHADSrMw5ju/

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2344	AQUA PREMIUM Spoof.exe
2880	AQUA PREMIUM Spoof.exe
2800	AQUA PREMIUM Spoof.exe
2740	AQUA PREMIUM Spoof.exe
1424	AQUA PREMIUM Spoof.exe
1740	AQUA PREMIUM Spoof.exe

Loads dropped DLL 14 IoCs

pid	Process
2156	7zFM.exe
2344	AQUA PREMIUM Spoof.exe
2880	AQUA PREMIUM Spoof.exe
1200	Process not Found
1200	Process not Found
2156	7zFM.exe
2800	AQUA PREMIUM Spoof.exe
2740	AQUA PREMIUM Spoof.exe
1200	Process not Found
2156	7zFM.exe
1424	AQUA PREMIUM Spoof.exe
1740	AQUA PREMIUM Spoof.exe
1200	Process not Found
1200	Process not Found

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016de8-31.dat	upx
behavioral1/memory/2880-33-0x000007FEF6280000-0x000007FEF66E6000-memory.dmp	upx
behavioral1/memory/2740-69-0x000007FEF6280000-0x000007FEF66E6000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2156	7zFM.exe
2156	7zFM.exe
1960	powershell.exe
2156	7zFM.exe
2156	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2156	7zFM.exe
Token: 35	2156	7zFM.exe
Token: SeSecurityPrivilege	2156	7zFM.exe
Token: SeSecurityPrivilege	2156	7zFM.exe
Token: SeSecurityPrivilege	2156	7zFM.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeSecurityPrivilege	2156	7zFM.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2156	7zFM.exe
2156	7zFM.exe
2156	7zFM.exe
2156	7zFM.exe
2156	7zFM.exe
2156	7zFM.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2344	2156	7zFM.exe	30
PID 2156 wrote to memory of 2344	2156	7zFM.exe	30
PID 2156 wrote to memory of 2344	2156	7zFM.exe	30
PID 2344 wrote to memory of 2880	2344	AQUA PREMIUM Spoof.exe	31
PID 2344 wrote to memory of 2880	2344	AQUA PREMIUM Spoof.exe	31
PID 2344 wrote to memory of 2880	2344	AQUA PREMIUM Spoof.exe	31
PID 2156 wrote to memory of 2800	2156	7zFM.exe	32
PID 2156 wrote to memory of 2800	2156	7zFM.exe	32
PID 2156 wrote to memory of 2800	2156	7zFM.exe	32
PID 2800 wrote to memory of 2740	2800	AQUA PREMIUM Spoof.exe	34
PID 2800 wrote to memory of 2740	2800	AQUA PREMIUM Spoof.exe	34
PID 2800 wrote to memory of 2740	2800	AQUA PREMIUM Spoof.exe	34
PID 2156 wrote to memory of 1708	2156	7zFM.exe	35
PID 2156 wrote to memory of 1708	2156	7zFM.exe	35
PID 2156 wrote to memory of 1708	2156	7zFM.exe	35
PID 1708 wrote to memory of 1960	1708	cmd.exe	37
PID 1708 wrote to memory of 1960	1708	cmd.exe	37
PID 1708 wrote to memory of 1960	1708	cmd.exe	37
PID 2156 wrote to memory of 1424	2156	7zFM.exe	38
PID 2156 wrote to memory of 1424	2156	7zFM.exe	38
PID 2156 wrote to memory of 1424	2156	7zFM.exe	38
PID 1424 wrote to memory of 1740	1424	AQUA PREMIUM Spoof.exe	39
PID 1424 wrote to memory of 1740	1424	AQUA PREMIUM Spoof.exe	39
PID 1424 wrote to memory of 1740	1424	AQUA PREMIUM Spoof.exe	39

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AQUA PREMIUM (1).rar"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\7zOC68A86A6\AQUA PREMIUM Spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC68A86A6\AQUA PREMIUM Spoof.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\7zOC68A86A6\AQUA PREMIUM Spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC68A86A6\AQUA PREMIUM Spoof.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\7zOC68D6BD6\AQUA PREMIUM Spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC68D6BD6\AQUA PREMIUM Spoof.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\7zOC68D6BD6\AQUA PREMIUM Spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC68D6BD6\AQUA PREMIUM Spoof.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2740
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zOC68EEAE6\Respoof.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell "Disable-MMAgent -MemoryCompression"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\Users\Admin\AppData\Local\Temp\7zOC68C5667\AQUA PREMIUM Spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC68C5667\AQUA PREMIUM Spoof.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\7zOC68C5667\AQUA PREMIUM Spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC68C5667\AQUA PREMIUM Spoof.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zOC68EEAE6\Respoof.cmd

Filesize
65B

MD5
a64d3a4c1d61344273de4e3f2dd3b652

SHA1
245859a286db226f15a0c8c51c9b71f31ea1b79a

SHA256
6f4b8912c0f77f2e589e8fed98246680bdd01a442f91729ce15ee812b8f4d50e

SHA512
e564799596d11b71590569f8c7b31fe7446cabc2dc6bc423308edf7ad2fcb74cbc621891cc594a6b2ebc8320600d0ca2530e92042477246914c55f369d2856cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23442\python310.dll

Filesize
1.4MB

MD5
3f782cf7874b03c1d20ed90d370f4329

SHA1
08a2b4a21092321de1dcad1bb2afb660b0fa7749

SHA256
2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

SHA512
950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

Download Submit
\Users\Admin\AppData\Local\Temp\7zOC68A86A6\AQUA PREMIUM Spoof.exe

Filesize
5.9MB

MD5
47911cfecd3dcd8b505235dd9b187992

SHA1
9c874cead1208b3b77f0ae535d07522629e6e676

SHA256
3aac1ef0cd3825fbb753199f1fe31430f4aba354cc4fb8e7db74b63ac8f7efdf

SHA512
cac06ffeb06e83c2e0a4c98512dde8292c2800a35a4653621e6cdd2877293381ebf7f773456974b4181838e98916ff9a6c6d5ec2ec145398cfddbb2668889eec

Download Submit
memory/1960-131-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1960-132-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2740-69-0x000007FEF6280000-0x000007FEF66E6000-memory.dmp

Filesize
4.4MB

Download
memory/2880-33-0x000007FEF6280000-0x000007FEF66E6000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing