Analysis
-
max time kernel
128s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:12
Static task
static1
Behavioral task
behavioral1
Sample
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe
Resource
win10v2004-20220812-en
General
-
Target
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe
-
Size
1.4MB
-
MD5
e6898102b30f2e6971d3bd589a862b97
-
SHA1
a0af0ed9fa8bd5dc4c5f71ac18a96332da568d6f
-
SHA256
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7
-
SHA512
4b26dd8494ecad4abe86bca18397575dc48b75baad09f562ac56e46fb328c1903260febce7b62ce2f5d4d52ea521694e59946ef2e4749b092954168475b55ffa
-
SSDEEP
24576:a/YAXoZPDXLygBSTZaqdiXSp0c02uFG6dAk3xMIq:aQAXoZPDX/wTZaqdwk0c05HGirq
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SkinH_EL.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SkinH_EL.dll upx behavioral1/memory/832-57-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exepid process 832 0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exepid process 832 0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe 832 0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe 832 0085e316308f7155639c3b14dd10e33fede1781d57cb984df2f05774bd5aeaf7.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d