498d9aadff8469c14f053423fc2391b602ac2c74a4f93e3d121625579cf23f57

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
29-06-2022 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s8rp8qf1DaKw.exe
Size

12.2MB
MD5

bb8bf83d5fe4bc0f4b176350d16e8034
SHA1

27bba37957ce28558fbb8d36d379ec19bab1253b
SHA256

498d9aadff8469c14f053423fc2391b602ac2c74a4f93e3d121625579cf23f57
SHA512

bbe2bb4b95e1ecb5bb8bae784c684c6b2af0ba03fff1f1c80c6bf7cc3bf8ca6fdb519a041400a43f0acc7a0a3a2cf08118be2e3537cc945a0b6067875645f5d6

Score

9^/10

evasion upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	acprotect

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

s8rp8qf1DaKw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	s8rp8qf1DaKw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	s8rp8qf1DaKw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	s8rp8qf1DaKw.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	upx
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	upx
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	upx
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll	upx

Loads dropped DLL 9 IoCs

Processes:

s8rp8qf1DaKw.exe

pid	process
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe
4596	s8rp8qf1DaKw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

s8rp8qf1DaKw.exe

pid process

4596 s8rp8qf1DaKw.exe
4596 s8rp8qf1DaKw.exe
4596 s8rp8qf1DaKw.exe
4596 s8rp8qf1DaKw.exe

C:\Users\Admin\AppData\Local\Temp\s8rp8qf1DaKw.exe
"C:\Users\Admin\AppData\Local\Temp\s8rp8qf1DaKw.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll
Filesize
24KB

MD5
6c2b245e89428fb917a5805815a4054e

SHA1
5bcd987700dd761f02d2d1d024b8f20077985051

SHA256
0558bbdfe61eefb680e8560a7d4b174447a9516098f9cd8b4c84bf1552cee5c5

SHA512
ecb3fb77532d6ffa1ca08df05a6a86b18138356e63cb40edf68f97fc7fdf2e781a4ebeb1efdb9f13f947304312dd19ef5c4a78ddc60843f5f726cde69b2c57d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll
Filesize
24KB

MD5
6c2b245e89428fb917a5805815a4054e

SHA1
5bcd987700dd761f02d2d1d024b8f20077985051

SHA256
0558bbdfe61eefb680e8560a7d4b174447a9516098f9cd8b4c84bf1552cee5c5

SHA512
ecb3fb77532d6ffa1ca08df05a6a86b18138356e63cb40edf68f97fc7fdf2e781a4ebeb1efdb9f13f947304312dd19ef5c4a78ddc60843f5f726cde69b2c57d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll
Filesize
24KB

MD5
6c2b245e89428fb917a5805815a4054e

SHA1
5bcd987700dd761f02d2d1d024b8f20077985051

SHA256
0558bbdfe61eefb680e8560a7d4b174447a9516098f9cd8b4c84bf1552cee5c5

SHA512
ecb3fb77532d6ffa1ca08df05a6a86b18138356e63cb40edf68f97fc7fdf2e781a4ebeb1efdb9f13f947304312dd19ef5c4a78ddc60843f5f726cde69b2c57d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\KillProc.dll
Filesize
24KB

MD5
6c2b245e89428fb917a5805815a4054e

SHA1
5bcd987700dd761f02d2d1d024b8f20077985051

SHA256
0558bbdfe61eefb680e8560a7d4b174447a9516098f9cd8b4c84bf1552cee5c5

SHA512
ecb3fb77532d6ffa1ca08df05a6a86b18138356e63cb40edf68f97fc7fdf2e781a4ebeb1efdb9f13f947304312dd19ef5c4a78ddc60843f5f726cde69b2c57d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\Registry.dll
Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5DC6.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/4596-137-0x0000000002AB1000-0x0000000002AB3000-memory.dmp

Filesize
8KB

Download
memory/4596-140-0x0000000002AC1000-0x0000000002AC3000-memory.dmp

Filesize
8KB

Download
memory/4596-141-0x0000000002800000-0x0000000002814000-memory.dmp

Filesize
80KB

Download