e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe
Size

269KB
MD5

4d1bd75b6bed2a68abad0f27cea1f13d
SHA1

0d2a50d2cab028c825e46d11e4e00b794360c5c2
SHA256

e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7
SHA512

c1d2386631abe3c65135ab7e2cc13e8e660f20d5b1b2220eb35727a42c7b80db69b178f10021e43f952b6a67796db52e7426ac8548d5395431e36b2bd080e349
SSDEEP

6144:NrTcoj6kLCQNbPTIyOiMg9nVzXZcVU8gVBKIlY:Bgoj6idPTg5GVzJcpIlY

Score

9^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mriAA8D.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\mriAA8D.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

pid	process
2808	e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe
2808	e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\synserver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe"	e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

pid process

2808 e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe

C:\Users\Admin\AppData\Local\Temp\e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe
"C:\Users\Admin\AppData\Local\Temp\e2fb74dcb85391236f1d6da1838cef5f7e4588f83f17a8ceae9d504d1a28dbf7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mriAA8D.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mriAA8D.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/2808-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2808-135-0x00000000021B0000-0x0000000002223000-memory.dmp

Filesize
460KB

Download
memory/2808-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download