42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62

General

Target

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Size

492KB
MD5

f5537cdff66e5792950c4a3002481cfa
SHA1

b8faf1a0fe35b1ddec94eba2d011b39094f682ce
SHA256

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62
SHA512

d28518bb83e12be28ae8e91be7885cbbffd455742b96d10311bb7622af7294e6b1d9e59e2c30c21cd65d5880cf3f9cee62556b06d8815b3aaa13f452cb42898c

Score

9^/10

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\bel280F.tmp	acprotect
\Users\Admin\AppData\Local\Temp\bel280F.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

pid	process
3680	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
3680	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

Drops file in Windows directory 1 IoCs

Processes:

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

description ioc process

File created C:\Windows\wc98pp.dll 42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

description	ioc	process
File created	C:\Windows\wc98pp.dll	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

Modifies registry class 6 IoCs

Processes:

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

pid	process
3680	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
3680	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe
3680	42ebdac01ada5c26e19742d43772157010010e9d6ee93f0ea1856db3a9a5ff62.exe

\Users\Admin\AppData\Local\Temp\bel280F.tmp
MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\bel280F.tmp
MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/3680-116-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3680-117-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download