Analysis
-
max time kernel
35s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 12:08
Static task
static1
Behavioral task
behavioral1
Sample
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exe
Resource
win10v2004-20221111-en
General
-
Target
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exe
-
Size
333KB
-
MD5
4eacc22b45138599a96280b3dd051901
-
SHA1
1d0ad441ad400d76169a7928af38e2703b6a61e4
-
SHA256
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a
-
SHA512
fbdd91017cbf973314965ddec81c7dc32e7661b81573e4fd8da4163fb1500e7d13093d6489896165d82b5cb8c9c5ec4ba987ec49288c7b9833007ad4321268fe
-
SSDEEP
6144:rzbsWpJuIDMzYlmpOkIpkZ1hQnBXczrceU2S7a393WnWYXKO6p6d2byzSkwBd2:XbRkSQY+zrdYq6d2lU
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\ykk6AF4.tmp acprotect -
Loads dropped DLL 1 IoCs
Processes:
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exepid process 1708 1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exepid process 1708 1b0a563cc6c01262a2a3a04c2f0d08af16a60d3e3d723e4c33109c5d63a4623a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\ykk6AF4.tmpFilesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1708-56-0x0000000030000000-0x000000003002E000-memory.dmpFilesize
184KB
-
memory/1708-57-0x0000000001B30000-0x0000000001BA4000-memory.dmpFilesize
464KB
-
memory/1708-58-0x0000000030000000-0x000000003002E000-memory.dmpFilesize
184KB
-
memory/1708-59-0x0000000001B30000-0x0000000001BA4000-memory.dmpFilesize
464KB