7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
Size

240KB
MD5

578b9aae50bab93d90e070f0f23a3cc0
SHA1

2bb4404ce1571eb1a9779edbc02c75e6d4d580a7
SHA256

7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05
SHA512

494889012ba1f52c41ff09f85c1e5c5b8a076f8045a04ad3e5494c7c3eb15607e95cb197edb50f355a26595f48abb09b243cabd42e655cc0e9cfa3d4b0beff63
SSDEEP

6144:mshXJafH0aiKuXxR9arh56NNOxvLHkAWUgybKvgpRiAdJSpERxuXooTZ23GIg:m0ctiKuXxR9uOOHmSRimSpERKF23G

Score

9^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000005c51-54.dat	acprotect

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Event Alert\Parameters\ServiceDll = "C:\\Windows\\system32\\RrmitlC.dll"	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1716-60-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1640	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RrmitlC.dll	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
Token: SeIncBasePriorityPrivilege	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 360	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	5
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 384	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	4
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 420	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	3
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 472	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	2
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 480	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	1
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 488	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	7
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 588	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	24
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 664	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	23
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 752	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	22
PID 1716 wrote to memory of 812	1716	7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe	21

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:888
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:1988
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1088
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:740
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1072
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:272
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:340
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:840
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
  2⤵
  PID:2012
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
  2⤵
  - Loads dropped DLL
  PID:1640

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:360
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe
  "C:\Users\Admin\AppData\Local\Temp\7aab64ca1ee768d93c0bb3356adeab4a94047803658c8637fd6633a78faf2e05.exe"
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1716

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\rrmitlc.dll

Filesize
60KB

MD5
3038e98f9a221ee544d3a6f47315e4d0

SHA1
a97590ef69b63fd2f0a7dc52a40ab2a9c2e41d15

SHA256
f825276e70090ffdef1d65b8a22079480c9e79327b799a04ec0644472a4c4d67

SHA512
e45254dbbea7ed428edfbfe5c222b4f229cd3be5ef7526ab802afa04a507b0753d4e6c8a87b496fa2061273d7fa093953e506e5ee7ae4e99c8241703eb9269f4

Download Submit
\Users\Admin\AppData\Local\Temp\lck1D71.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\SysWOW64\RrmitlC.dll

Filesize
60KB

MD5
3038e98f9a221ee544d3a6f47315e4d0

SHA1
a97590ef69b63fd2f0a7dc52a40ab2a9c2e41d15

SHA256
f825276e70090ffdef1d65b8a22079480c9e79327b799a04ec0644472a4c4d67

SHA512
e45254dbbea7ed428edfbfe5c222b4f229cd3be5ef7526ab802afa04a507b0753d4e6c8a87b496fa2061273d7fa093953e506e5ee7ae4e99c8241703eb9269f4

Download Submit
\Windows\SysWOW64\RrmitlC.dll

Filesize
60KB

MD5
3038e98f9a221ee544d3a6f47315e4d0

SHA1
a97590ef69b63fd2f0a7dc52a40ab2a9c2e41d15

SHA256
f825276e70090ffdef1d65b8a22079480c9e79327b799a04ec0644472a4c4d67

SHA512
e45254dbbea7ed428edfbfe5c222b4f229cd3be5ef7526ab802afa04a507b0753d4e6c8a87b496fa2061273d7fa093953e506e5ee7ae4e99c8241703eb9269f4

Download Submit
memory/1716-56-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1716-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1716-61-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download