Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 14:48
Static task
static1
Behavioral task
behavioral1
Sample
XMToolBox.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
XMToolBox.exe
Resource
win10v20210410
General
-
Target
XMToolBox.exe
-
Size
5.5MB
-
MD5
b5e5b774f5228a39349ce7562d885f5f
-
SHA1
cb4525243f5489c17bd010445efc80a1e38afc76
-
SHA256
fa1462d4e6fce1dbb5c4813cd596555e3a583face9932e173af9913a421fb428
-
SHA512
4415201004971071cf3a7c6fd479635a1e4e88ccc217c763217ed0352509b7953d03dc9c999b5a3f638fac3b2183ffbca11badd45f817349da218e31b82c0403
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\Documents\SkinH_EL.dll acprotect -
Processes:
resource yara_rule \Users\Admin\Documents\SkinH_EL.dll upx -
Loads dropped DLL 1 IoCs
Processes:
XMToolBox.exepid process 1892 XMToolBox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XMToolBox.exepid process 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
XMToolBox.exepid process 1892 XMToolBox.exe 1892 XMToolBox.exe 1892 XMToolBox.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\Documents\SkinH_EL.dllMD5
147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d