Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe
Resource
win10v2004-20220901-en
General
-
Target
eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe
-
Size
348KB
-
MD5
659dd746665e89feee6216ffd94fd420
-
SHA1
ec750b78ee9ed7ce37a7167b5152b23cf84702c4
-
SHA256
eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31
-
SHA512
65531dd5f957684b572566a85d7a0a8902e97b46f95e16ec567e86e5a90f69ea1762cc363a8f18cb401fb616d9ed0fd8ecb2076511d1635b2091a928fb596ca8
-
SSDEEP
6144:CKs3EQIHA7OctONehxZcdDxMJnD6iYRvCxJoSP5HFb:CN3EQ5OJNPDiQiYRAoSR
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a0000000126c8-57.dat acprotect -
resource yara_rule behavioral1/files/0x000a0000000126c8-57.dat upx -
Loads dropped DLL 1 IoCs
pid Process 1468 eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Skin5Dai.dll eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1468 eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe 1468 eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe 1468 eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe"C:\Users\Admin\AppData\Local\Temp\eb3836dc2cc70343ef44f3d38086863d53ee7bbfd18f02cbc397c628304caa31.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1468
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD56e79984e5c29ee9108fefdfa6c31c2f4
SHA1a6869af96cb81a627ba4b68c5ebc691409e7e28e
SHA25625524972067eb99cb966f51704bbaae1f47f4fb932b6176d4d517fbcf04a20df
SHA512fef55831174bb14cafe2e4951675637b7ff3d9821d425f35c671a4d784bb8030d74a61ba38e24768ca9419a8721208ed075fbbf8318049045030bc3a1d68fc31