574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
Size

656KB
MD5

69306b2a40b36f4c4a19d323bbafa285
SHA1

af4ba9bd7e6ebe90c2e7c65e5939055b4408c151
SHA256

574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6
SHA512

dedec3db2d6a4ee35eb1fbd3c50fd23467ee74501681b2c5380a52bc9ac3ce98cba0316b577ae514ba61eaff90ea7df5f8ce30c9a315af4019f3c21a9b3e16fa

Score

10^/10

evasion suricata trojan upx

Malware Config

Signatures

suricata: ET MALWARE Win32/DownloadAdmin Activity
suricata: ET MALWARE Win32/DownloadAdmin Activity
suricata

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll	upx
behavioral2/memory/2500-153-0x0000000003290000-0x000000000329C000-memory.dmp	upx
behavioral2/memory/2500-155-0x0000000003290000-0x000000000329C000-memory.dmp	upx

Loads dropped DLL 17 IoCs

Processes:

574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

pid	process
612	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
624	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
2500	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

description	pid	process	target process
PID 612 wrote to memory of 624	612	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
PID 612 wrote to memory of 624	612	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
PID 612 wrote to memory of 624	612	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
PID 624 wrote to memory of 2500	624	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
PID 624 wrote to memory of 2500	624	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
PID 624 wrote to memory of 2500	624	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe	574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe

C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:612

C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"
3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\LuaBridge.dll
Filesize
62KB

MD5
4e08fe995ab74ba4d145ddb77ea095fc

SHA1
e4bb337e40069c097e7abd566b7427b11fb124ee

SHA256
ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17

SHA512
b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\026e996a3a5897970b058ffb093a163a1d763649.dll
Filesize
11KB

MD5
0a29e1b270ccea61aba7d7cdd10e0388

SHA1
76bf03361bcaef475ffb864bc1903c9bcaac7b44

SHA256
67328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb

SHA512
d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dll
Filesize
193KB

MD5
e390287499549de31da007f7f0ae4d10

SHA1
a8c6caebb151d60ea56f4c96a7194c0e5f076692

SHA256
b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b

SHA512
6c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dll
Filesize
80KB

MD5
4bf7db111acfa7c28ad36606107b3322

SHA1
6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3

SHA256
bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0

SHA512
0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dll
Filesize
80KB

MD5
4bf7db111acfa7c28ad36606107b3322

SHA1
6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3

SHA256
bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0

SHA512
0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\FloatingProgress.dll
Filesize
25KB

MD5
0f26c6d34d3841e93145dd00d0175651

SHA1
57b068569d0eb2336503beed87589629ab2a6f1f

SHA256
0cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741

SHA512
72785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\LuaBridge.dll
Filesize
62KB

MD5
4e08fe995ab74ba4d145ddb77ea095fc

SHA1
e4bb337e40069c097e7abd566b7427b11fb124ee

SHA256
ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17

SHA512
b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\LuaXml_lib.dll
Filesize
11KB

MD5
7292b642bd958aeb7fd7cfd19e45b068

SHA1
19a800620d041634abae5b5d096cb0e87ce4c188

SHA256
90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09

SHA512
bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\LuaXml_lib.dll
Filesize
11KB

MD5
7292b642bd958aeb7fd7cfd19e45b068

SHA1
19a800620d041634abae5b5d096cb0e87ce4c188

SHA256
90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09

SHA512
bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\System.dll
Filesize
10KB

MD5
7e3c808299aa2c405dffa864471ddb7f

SHA1
b5de7804dd35ed7afd0c3b59d866f1a0749495e0

SHA256
91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

SHA512
599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\UACInfo.dll
Filesize
4KB

MD5
d02a497be5f89c44827f142c4662f591

SHA1
38f83ccbac11de069df0e1cd79a6fdf7f006516c

SHA256
6d29dfd24695535b5973d8261d93373603ceaae03ab97662fe1b3dcc47d18226

SHA512
81c87f9d56a8ab7703a4effd3ba7b982b6765ecbdc0dbb1c595f549c4310a5db57dcdc38929eafe56983ea8cefc0b572c3faf82a4b62eb7c564b05550215f1c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\f40368059830399ce8189100003d317f2739d087.dll
Filesize
52KB

MD5
4a4845ba1666907f708c9c10a31ec227

SHA1
1ebf626adc84147e5114885ce779f92d6eb68f3a

SHA256
a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d

SHA512
d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\f40368059830399ce8189100003d317f2739d087.dll
Filesize
52KB

MD5
4a4845ba1666907f708c9c10a31ec227

SHA1
1ebf626adc84147e5114885ce779f92d6eb68f3a

SHA256
a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d

SHA512
d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\lua51.dll
Filesize
255KB

MD5
fceee0026aafd237afdb4aea4ecd3557

SHA1
3e10da57143599eae915a688178abada78b8d82b

SHA256
85db1e17c0fad08d9732405e781cda1e1613ace31c540a6e559cd8777df2c62c

SHA512
9c974918c8afec8d8a58fc1239f269544b9dfe867459bb61901462f56f71a3dd574d3b2263dd14b99ff8a23c8096c408be3620785fd4476b975a43b999f559f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll
Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh74C9.tmp\versioninfo.dll
Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr746B.tmp\LuaBridge.dll
Filesize
62KB

MD5
4e08fe995ab74ba4d145ddb77ea095fc

SHA1
e4bb337e40069c097e7abd566b7427b11fb124ee

SHA256
ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17

SHA512
b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f

Download Submit
memory/624-131-0x0000000000000000-mapping.dmp

Download
memory/2500-148-0x0000000003260000-0x000000000326E000-memory.dmp

Filesize
56KB

Download
memory/2500-133-0x0000000000000000-mapping.dmp

Download
memory/2500-137-0x0000000074820000-0x000000007487E000-memory.dmp

Filesize
376KB

Download
memory/2500-143-0x0000000003220000-0x0000000003236000-memory.dmp

Filesize
88KB

Download
memory/2500-140-0x0000000003211000-0x0000000003213000-memory.dmp

Filesize
8KB

Download
memory/2500-153-0x0000000003290000-0x000000000329C000-memory.dmp

Filesize
48KB

Download
memory/2500-154-0x0000000074820000-0x000000007487E000-memory.dmp

Filesize
376KB

Download
memory/2500-155-0x0000000003290000-0x000000000329C000-memory.dmp

Filesize
48KB

Download