Analysis
-
max time kernel
152s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 21:20
General
-
Target
83319b910ce4c2599ff5ce1d2e981d632565e5c6acc872fb41e0e78d07a85ac1.exe
-
Size
1.6MB
-
MD5
5b5cc74e994b8a705f5e1a4e7e19d6c6
-
SHA1
8d2f2c7c30d34dd076d7b6e39fb08a7234567451
-
SHA256
83319b910ce4c2599ff5ce1d2e981d632565e5c6acc872fb41e0e78d07a85ac1
-
SHA512
f809d34711c4840f32a99816b166362a405e00a885b4a3b09aee97753dc2571e1756fd1cf0c894918c59fea0fad39965ae3b99e531fb3417912ba296ceb1882f
-
SSDEEP
24576:dVqe2voqd6cFFrJofAg/xfEn2PevJImXU9bUzm:vqe2voS6cFFrJyACE2mvJImXMF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83319b910ce4c2599ff5ce1d2e981d632565e5c6acc872fb41e0e78d07a85ac1.exe"C:\Users\Admin\AppData\Local\Temp\83319b910ce4c2599ff5ce1d2e981d632565e5c6acc872fb41e0e78d07a85ac1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4481⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\dmk8122.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
memory/1360-55-0x0000000000400000-0x000000000068B000-memory.dmpFilesize
2.5MB
-
memory/1360-56-0x0000000000320000-0x0000000000393000-memory.dmpFilesize
460KB
-
memory/1360-57-0x0000000000400000-0x000000000068B000-memory.dmpFilesize
2.5MB