b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885

General

Target

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
Size

881KB
MD5

6af496f3bbdba25ce16e8ba856feb716
SHA1

459e6c3a7e8a3a6676c3282ce640658a3340e927
SHA256

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885
SHA512

e93fb232fd5d87840d19fe13904b8b9bd708d543cf50f0a2eecf4aa2cd99f50b338e059efd4a32de540d64438c16b57f32d0c516ca676745bbdf1c6d8ac54627
SSDEEP

24576:mQMSdDaw0gZEJs2QC/TwYBoGrHBYD9nceNaxhP6tM:m6T0gZEJJQgwghFYZhaqS

Score

9^/10

aspackv2 upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\hideprocess.dll	acprotect

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

1552 svchost.exe
576 svchost.exe

pid	process
1552	svchost.exe
576	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\hideprocess.dll	upx

Loads dropped DLL 4 IoCs

Processes:

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exesvchost.exe

pid	process
1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
1552	svchost.exe
1552	svchost.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1672-55-0x0000000000A20000-0x0000000000B80000-memory.dmp	autoit_exe
behavioral1/memory/1672-57-0x0000000000A20000-0x0000000000B80000-memory.dmp	autoit_exe
behavioral1/memory/1672-56-0x0000000000A20000-0x0000000000B80000-memory.dmp	autoit_exe
behavioral1/memory/1672-58-0x0000000000A20000-0x0000000000B80000-memory.dmp	autoit_exe
behavioral1/memory/1672-64-0x0000000000A20000-0x0000000000B80000-memory.dmp	autoit_exe
behavioral1/memory/1552-66-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/1552-67-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/1552-65-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/1552-69-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/576-77-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/576-78-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/1552-75-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/576-76-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe
behavioral1/memory/576-80-0x00000000003B0000-0x00000000004AB000-memory.dmp	autoit_exe

Drops file in System32 directory 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hideprocess.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\hideprocess.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\hideprocess.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exesvchost.exe

description	pid	process	target process
PID 1672 wrote to memory of 1552	1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 1672 wrote to memory of 1552	1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 1672 wrote to memory of 1552	1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 1672 wrote to memory of 1552	1672	b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe	svchost.exe
PID 1552 wrote to memory of 576	1552	svchost.exe	svchost.exe
PID 1552 wrote to memory of 576	1552	svchost.exe	svchost.exe
PID 1552 wrote to memory of 576	1552	svchost.exe	svchost.exe
PID 1552 wrote to memory of 576	1552	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe
"C:\Users\Admin\AppData\Local\Temp\b96c42cc1bbd96194b4310018835150dd284e3c2d74a8fdba5693b40541a0885.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe" /ErrorStdOut
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
C:\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
C:\Windows\SysWOW64\hideprocess.dll

Filesize
21KB

MD5
9858f738d68d5d0f055ba3d879348a5c

SHA1
8723520ff149161d0ebc1e8ce34efcae90a0a37b

SHA256
f2439030d186ba9f5ec6c3d484f3436ee2a2cc889a077a9c15a7650690498981

SHA512
61167a4ba5803aa8b96e75fcecdb19161a09e32fd01fd828ddd92e8e6c61c27d0be28ea00123d72b0562eafdc5440ae26be672a45276faa6a048ea813fdb8a39

Download Submit
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
\Users\Admin\AppData\Local\Temp\bmy\svchost.exe

Filesize
473KB

MD5
b143d46389ef0494b4475c9e929c7d9b

SHA1
755e63660ff30bfef1c811dbb0e7ef0b87376130

SHA256
7dc38fc42c1cadabdad56993598d3ae4630d3bd2e29603b8b868f7ea6fe0f00c

SHA512
c06d0681ce865c5ec03d4e81c1ebbf258f8dc6716abcbd3d640bcbb033c7b0a7ebe6a9bbfe82f3e9ee997b269f4f8c3ac93a9c0ce65b86e4d19e1e734a38bd08

Download Submit
memory/576-76-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/576-77-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/576-72-0x0000000000000000-mapping.dmp

Download
memory/576-78-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/576-80-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1552-61-0x0000000000000000-mapping.dmp

Download
memory/1552-69-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1552-65-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1552-67-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1552-66-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1552-75-0x00000000003B0000-0x00000000004AB000-memory.dmp

Filesize
1004KB

Download
memory/1672-64-0x0000000000A20000-0x0000000000B80000-memory.dmp

Filesize
1.4MB

Download
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-58-0x0000000000A20000-0x0000000000B80000-memory.dmp

Filesize
1.4MB

Download
memory/1672-56-0x0000000000A20000-0x0000000000B80000-memory.dmp

Filesize
1.4MB

Download
memory/1672-57-0x0000000000A20000-0x0000000000B80000-memory.dmp

Filesize
1.4MB

Download
memory/1672-55-0x0000000000A20000-0x0000000000B80000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads