2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (15).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurlpp.dll	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

setup_installer.exesetup_install.exe

pid process

2460 setup_installer.exe
3604 setup_install.exe
Loads dropped DLL 5 IoCs

Processes:

setup_install.exe

pid process

3604 setup_install.exe
3604 setup_install.exe
3604 setup_install.exe
3604 setup_install.exe
3604 setup_install.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2460	setup_installer.exe
3604	setup_install.exe

pid	process
3604	setup_install.exe
3604	setup_install.exe
3604	setup_install.exe
3604	setup_install.exe
3604	setup_install.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8 (15).exesetup_installer.exe

description	pid	process	target process
PID 3408 wrote to memory of 2460	3408	8 (15).exe	setup_installer.exe
PID 3408 wrote to memory of 2460	3408	8 (15).exe	setup_installer.exe
PID 3408 wrote to memory of 2460	3408	8 (15).exe	setup_installer.exe
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	setup_install.exe
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	setup_install.exe
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	setup_install.exe

C:\Users\Admin\AppData\Local\Temp\8 (15).exe
"C:\Users\Admin\AppData\Local\Temp\8 (15).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurl.dll
MD5
b0af2734dbce594cf179f67ae1f9b3db

SHA1
42e756cbe2678ffddd404df87acf9fff60b12e43

SHA256
4237db556c7031a476a9b0242a77e10e868dc2827b5e4485dd729cd77cb20159

SHA512
d94627d3838b7ba4e21dfa44c8f45559968081467c9f7c3916625b84cf37d1c06d7c43274ff5b3ede6efca4d8432548da379a6fb58a477bc67cdcc742acadb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libstdc++-6.dll
MD5
2f7ab6f53e5bbd33e32a0285b6f13281

SHA1
6ee8703002a83ef8e619a5a862289c4014a5cdb1

SHA256
a038cb21befc10828afc8400e584fc353c16147c254a1ef32dbe3da637c7fc37

SHA512
b51c4a5ac11a75f7583b360552fb2ab878a1480e56b73ad4119ae7f055915f50a0e5e3d4cbe2484afee669a3b90f3b5c5435f1af1f007c85b541ac6fab026624

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe
MD5
a3ca32ebdba2c07c2d386bb31cbd6d51

SHA1
e7841e1f475f922d5264b5ce5d123a1b3927f9e6

SHA256
0ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b

SHA512
c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe
MD5
c3db252e4b71cb143ec42aef92ebb106

SHA1
76285a622cce438679723f60d5b9523de5a862e5

SHA256
1e15c98d4fb7c02175cf6d5e5327e32563a70fb6c8164d36a0054de66ef6dbb6

SHA512
3ddfa949eaf9513c2ce16b74e3f6d8e258e4aeafc6aa72871a5da2adf1bd28bb38c500342dbc7b944671adf04f7e18100377e886a4129d2ce81cac4f1d19c43b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
74231678f536a19b3016840f56b845c7

SHA1
a5645777558a7d5905e101e54d61b0c8c1120de3

SHA256
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4

SHA512
4117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
74231678f536a19b3016840f56b845c7

SHA1
a5645777558a7d5905e101e54d61b0c8c1120de3

SHA256
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4

SHA512
4117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurl.dll
MD5
d12176c40e040b651ffa54219c13a7db

SHA1
f408a37d51719d5019fa40f3a80c5284e952e8e1

SHA256
aa0505cf1991544e952edbcd255f41a7af05680cfc8fb94166082ef48b5203f2

SHA512
8d990fcdea23227bf078c670d4b39b1f7d6c3e06f880f6351d934dd3d349609053526d45d13bf8bff6594e6f97208b2d42af3b9a778cbe5650f44ca29affe007

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurl.dll
MD5
d12176c40e040b651ffa54219c13a7db

SHA1
f408a37d51719d5019fa40f3a80c5284e952e8e1

SHA256
aa0505cf1991544e952edbcd255f41a7af05680cfc8fb94166082ef48b5203f2

SHA512
8d990fcdea23227bf078c670d4b39b1f7d6c3e06f880f6351d934dd3d349609053526d45d13bf8bff6594e6f97208b2d42af3b9a778cbe5650f44ca29affe007

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libgcc_s_dw2-1.dll
MD5
e1cc94ed76cc58a7673dd57c99b42504

SHA1
5a9295a2b89039963ecbeea76bfcd0d67f90c368

SHA256
865e8d77a9ce62fc14248a6eb16c8f8bf7db82becb15d649ee0e487a9836f1dd

SHA512
bacaf0fbbdb053d691ca2da546a3dd7a3aedc23e44172402be5ad62121f0610d4495fc1096685f5df2bcc973fc418399f3824b0ed9fbca9f5fc4678bbc396cd2

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libstdc++-6.dll
MD5
3268196eaad8b0e697b6c884fdf443c5

SHA1
b100e145f7035e19934ee2551cc54d92e1a07ba7

SHA256
52310e1dda07a2e6ed9194cc141d3657ab02dc1a5a4bcd2b7c139fd0900632f0

SHA512
706b0eb2a57c7bfc4fcd59df8ac2219b692673988cb6a91c417aad39bd5a478578e3fcfe782b66972a44fb6205ae7bca44fed194f0066aee7d206fa93e256631

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC9927914\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
memory/2460-114-0x0000000000000000-mapping.dmp

Download
memory/3604-117-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General