38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3

Analysis

Target

pocketrar350sc.exe
Size

381KB
MD5

a6a4daa74d974f2d92b35392207070ce
SHA1

6ece78cd87fe221ec4113cad8d41bef2475408ea
SHA256

38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3
SHA512

7a1cc21ec30728aadc04146b3a4acaf1b46359d49058a2143e08aa9f999360e92e80f968d0ca820d32959b08028aa3639796564b24c7474bc6a8f38aade19a91

Score

9^/10

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\kvkD569.tmp	acprotect

Loads dropped DLL 1 IoCs

Processes:

pocketrar350sc.exe

pid process

2036 pocketrar350sc.exe

pid	process
2036	pocketrar350sc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

Processes:

pocketrar350sc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	pocketrar350sc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

pocketrar350sc.exe

pid process

2036 pocketrar350sc.exe
2036 pocketrar350sc.exe
2036 pocketrar350sc.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\kvkD569.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download