1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04

General

Target

1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
Size

609KB
MD5

4033cfb31322fb4b2d4111c1a8abf710
SHA1

8ff395ea56a24d635b892ef865f695d7b991e745
SHA256

1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04
SHA512

366de937ef359556c46cc81b375914b7185afc8b54990765a9e15fba8e67a3269854994a73a9e0b7a4eddd596cb361973b45c67c5ef50c91c7a94102f21c3a9e
SSDEEP

12288:4dmKE/bK7Fa64btPMfn1PJY8GbOsyRCAA8lR3hUXpMzrS:XKEK7FN4bhM/1BY8GRqn3aMXS

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e45-134.dat	acprotect
behavioral2/files/0x0006000000022e45-133.dat	acprotect
behavioral2/files/0x0006000000022e45-139.dat	acprotect
behavioral2/files/0x0006000000022e45-141.dat	acprotect
behavioral2/files/0x0006000000022e45-140.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4968	AegisI5Installer.exe

Loads dropped DLL 4 IoCs

pid	Process
4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
4968	AegisI5Installer.exe
4968	AegisI5Installer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AegisI5Installer.exe	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
4968	AegisI5Installer.exe
4968	AegisI5Installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4968	4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe	83
PID 4412 wrote to memory of 4968	4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe	83
PID 4412 wrote to memory of 4968	4412	1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe	83

C:\Users\Admin\AppData\Local\Temp\1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe
"C:\Users\Admin\AppData\Local\Temp\1421ec87090ca3c9c41c5b3dc83f0256c99bb4f562bfbc9fc7cb2bdaa28d5e04.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\AegisI5Installer.exe
  "C:\Windows\system32\AegisI5Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pki6798.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pki6798.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pki6798.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pki6798.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pki6798.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\SysWOW64\AegisI5Installer.exe

Filesize
368KB

MD5
2d63a311f064e635d4bb93856be1257d

SHA1
e9f6679588cf5247279eddab3856b25d4fa1a06b

SHA256
792ca2426af914d8b7a76825842196a1083319d98108f60bd740f32a3d9d4020

SHA512
35293aa74c2e147ad3a442acf753d669ba0033229b6ba5636898fd0743aced0186bd09e0fce263ec4c8d4de2a07ae4f72133ed648fe17fca420b8a9ab2d0038f

Download Submit
C:\Windows\SysWOW64\AegisI5Installer.exe

Filesize
368KB

MD5
2d63a311f064e635d4bb93856be1257d

SHA1
e9f6679588cf5247279eddab3856b25d4fa1a06b

SHA256
792ca2426af914d8b7a76825842196a1083319d98108f60bd740f32a3d9d4020

SHA512
35293aa74c2e147ad3a442acf753d669ba0033229b6ba5636898fd0743aced0186bd09e0fce263ec4c8d4de2a07ae4f72133ed648fe17fca420b8a9ab2d0038f

Download Submit
memory/4412-135-0x0000000002290000-0x0000000002303000-memory.dmp

Filesize
460KB

Download
memory/4412-132-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4412-142-0x0000000002290000-0x0000000002303000-memory.dmp

Filesize
460KB

Download
memory/4412-144-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4968-136-0x0000000000000000-mapping.dmp

Download
memory/4968-143-0x0000000002600000-0x0000000002673000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing