5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe
Size

1.4MB
MD5

5f17251ef4452c3c6eafde93d477b4fe
SHA1

b21932d65881272117852ee431c563843f020d7a
SHA256

5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a
SHA512

b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520
SSDEEP

24576:GxliHqUx/wjaHi5kUEzIJ93+UpLV9RkQZ0g7P+zhDa+aGd++wZJnOnpok+EcH:Gxj0YjaS93pdVZ0gKzg+aGo9Z8nmkqH

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000014112-64.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1956	Au_.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014112-64.dat	upx

Loads dropped DLL 9 IoCs

pid	Process
364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe
1956	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000013aad-55.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-55.dat	nsis_installer_2
behavioral1/files/0x0008000000013aad-57.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-57.dat	nsis_installer_2
behavioral1/files/0x0008000000013aad-60.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-60.dat	nsis_installer_2
behavioral1/files/0x0008000000013aad-59.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-59.dat	nsis_installer_2
behavioral1/files/0x0008000000013aad-62.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-62.dat	nsis_installer_2
behavioral1/files/0x0008000000013aad-61.dat	nsis_installer_1
behavioral1/files/0x0008000000013aad-61.dat	nsis_installer_2

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26
PID 364 wrote to memory of 1956	364	5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe	26

C:\Users\Admin\AppData\Local\Temp\5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe
"C:\Users\Admin\AppData\Local\Temp\5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
\Users\Admin\AppData\Local\Temp\319792\MyNsisSkin.dll

Filesize
324KB

MD5
c42575c6e2e273c04eb7bc3e4119e337

SHA1
658e3d042e28196a321ee6446b9e6845d5478abc

SHA256
9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736

SHA512
b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308

Download Submit
\Users\Admin\AppData\Local\Temp\nsd79F3.tmp\MyNsisExtend.dll

Filesize
1000KB

MD5
e742994a264d88033d595cbc09499f16

SHA1
7e86669bb75832cc37e26717f32b4132a6fd3c13

SHA256
64f931bada36929605ea37aba72e9d6de40a5b06ee6149394f709ce26eb1f10f

SHA512
0db617ed3b5ac6bd0ad03083ffdbfc0c001b0de10cbe0c9d66d6b5981388c6b1437356006cedc8d82970fa87ab2cddd5e78b489003e28364b2cbe9ceab797cef

Download Submit
\Users\Admin\AppData\Local\Temp\nsd79F3.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsd79F3.tmp\nsDialogs.dll

Filesize
9KB

MD5
ab73c0c2a23f913eabdc4cb24b75cbad

SHA1
6569d2863d54c88dcf57c843fc310f6d9571a41e

SHA256
3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

SHA512
99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

Download Submit
\Users\Admin\AppData\Local\Temp\nsd79F3.tmp\nsRandom.dll

Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.4MB

MD5
5f17251ef4452c3c6eafde93d477b4fe

SHA1
b21932d65881272117852ee431c563843f020d7a

SHA256
5eabf328353c3fdce1903061f9f8850c3ad2520522d54ce53af75794ad64cc4a

SHA512
b05b72dc06fdc8a1e4bcf88f09fbda63e61e37b04f6b384b90d5ba5c4891872524ad9f353b056f17fe07c794660558244bc833c46ac2fc807f001c0bb2265520

Download Submit
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1956-66-0x0000000002000000-0x0000000002053000-memory.dmp

Filesize
332KB

Download
memory/1956-71-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1956-73-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download