ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782

Analysis

max time kernel
57s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
Size

365KB
MD5

006551be2fc93b94b88a04eadbf68a05
SHA1

d3ab2c2f54c155c50aa86f8c9d6e677ca9758e5f
SHA256

ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782
SHA512

6a15dd41e8877cdfdd645b41d99904bca77ab73c5eb4a3005991f085dc6db3640cf9a12ad63f1422dce898fb6d259bc1b3dbb037fc711e30de1cc6e8d73cf339
SSDEEP

6144:Z4SUjhtItxwV3vaHIIeHL+iXFBwTw0cl7FSlmPJF6:CItxwV3vaHIIBeUd6cAF6

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	acprotect
behavioral1/memory/1960-76-0x00000000744D0000-0x00000000744D9000-memory.dmp	acprotect

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll	upx
behavioral1/memory/1960-76-0x00000000744D0000-0x00000000744D9000-memory.dmp	upx

Loads dropped DLL 17 IoCs

Processes:

ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe

pid	process
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
1960	ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe
"C:\Users\Admin\AppData\Local\Temp\ece84286755a799d5810fbacfd3f8d06b6ba6ad981a7499f7b5ecd9345322782.exe"
1⤵
- Loads dropped DLL
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst66D0.tmp\InstallOptions.dll
Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\inetc.dll
Filesize
20KB

MD5
c498ae64b4971132bba676873978de1e

SHA1
92e4009cd776b6c8616d8bffade7668ef3cb3c27

SHA256
5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

SHA512
8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nst66D0.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/1960-76-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-72-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-73-0x00000000744C0000-0x00000000744C9000-memory.dmp

Filesize
36KB

Download
memory/1960-74-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-75-0x00000000744C0000-0x00000000744C9000-memory.dmp

Filesize
36KB

Download
memory/1960-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1960-77-0x00000000744C0000-0x00000000744C9000-memory.dmp

Filesize
36KB

Download
memory/1960-78-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-79-0x00000000744C0000-0x00000000744C9000-memory.dmp

Filesize
36KB

Download
memory/1960-80-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-81-0x00000000744D0000-0x00000000744D9000-memory.dmp

Filesize
36KB

Download
memory/1960-82-0x00000000744C0000-0x00000000744C9000-memory.dmp

Filesize
36KB

Download