d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8

General

Target

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
Size

13.5MB
MD5

fb58d05cae958fff426c8ca2f4694ca5
SHA1

0c7a92890d523da45bf42de083f27c486dd906d8
SHA256

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8
SHA512

d1cace6d24221208cae0a06a66012da0bd4a15d8858eba89f5648fd1fe4f308d2b2116534668aee3f11b6a602bbe5b9a086cdb6f67d77899f4d68c708caa3aef
SSDEEP

393216:sIQL6oMHOW5gZPkSX1VWCw0r1hXD0Q92ArZU0:spL62k01VZr3p9230

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\enk872B.tmp	acprotect
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE_NSIS.dll	acprotect
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE.dll	acprotect

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE_NSIS.dll	upx
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE.dll	upx
behavioral1/memory/1376-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1376-63-0x0000000010000000-0x0000000010003000-memory.dmp	upx
behavioral1/memory/1376-65-0x0000000004700000-0x00000000047DF000-memory.dmp	upx

Loads dropped DLL 6 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid	process
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid process

1376 d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid	process
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
1376	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

C:\Users\Admin\AppData\Local\Temp\d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
"C:\Users\Admin\AppData\Local\Temp\d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\enk872B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE.dll

Filesize
268KB

MD5
90f6da1d1381c4f0d86946cf354561ed

SHA1
533622c87081586eb6f32957e4963a2647b6de1c

SHA256
fd135dfa66a30f99ed3184a5b81b8f2198a62609da8a730c6a7f16b28f8f3b27

SHA512
1980c8f837ff2bf533a5c5a547b28c318a9369642df98341a9caca628d9ebf19aceee94db3efed7ee07e93aed340f856dcfd8a9c7beeeaf4f3b6d538373ab15b

Download Submit
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\SkinSE_NSIS.dll

Filesize
17KB

MD5
fc03fe6204b70f4315539eba5a71860d

SHA1
8eaffe6fcca6ae460a26dfa36362753304ab0385

SHA256
ef00587e3999902f66fa89f8f7a2a9de6e85f12a2649c7ca8affe1c9d1531daf

SHA512
722481b0bd20d1a40169098ec90206c06bc87ee8f19af4995c44d6bf9afea57b0b4fc9b676646447412c25838302a474fda419dc7640466afe34145ee9b0be8e

Download Submit
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nso88D4.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/1376-57-0x0000000001C30000-0x0000000001CA3000-memory.dmp

Filesize
460KB

Download
memory/1376-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1376-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1376-63-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1376-65-0x0000000004700000-0x00000000047DF000-memory.dmp

Filesize
892KB

Download
memory/1376-66-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1376-67-0x0000000001C30000-0x0000000001CA3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads