be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e

General

Target

be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe
Size

884KB
MD5

3c16654303a97ce23f67aafd0d80a344
SHA1

90858bef0e3b65e244bbdefa34d2c35b13a755fa
SHA256

be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e
SHA512

c1f4d2577a34c8fef453ea91cf60c5c88a07f33360311f2ec8af8ccd29c176fdc3d084490dff52db67158bffa0058efc0d076ada619893d41cb1e4197dbcf8fe
SSDEEP

24576:Xv4vMb7TsWKdeORfAoMJoyzkKFTQihQnA1:AkjlEMmygUT/b1

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122fa-55.dat	acprotect
behavioral1/files/0x000b0000000122fa-63.dat	acprotect
behavioral1/files/0x000b0000000122fa-64.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
952	is-PVSOM.tmp

Loads dropped DLL 5 IoCs

pid	Process
1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe
1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe
952	is-PVSOM.tmp
952	is-PVSOM.tmp
952	is-PVSOM.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	is-PVSOM.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28
PID 1668 wrote to memory of 952	1668	be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe	28

C:\Users\Admin\AppData\Local\Temp\be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe
"C:\Users\Admin\AppData\Local\Temp\be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\is-84DVQ.tmp\is-PVSOM.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-84DVQ.tmp\is-PVSOM.tmp" /SL4 $70122 C:\Users\Admin\AppData\Local\Temp\be4156838a935465a58598b081a22f82a31714f8f2bf8836888df78158944f4e.exe 515286 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-84DVQ.tmp\is-PVSOM.tmp

Filesize
572KB

MD5
6c771e6862cef3b18328bf5b6241c991

SHA1
655632265be57089137ed53960800e8089e3ceb9

SHA256
701b05147a5f39aba879e3fe136f10ff1399dc4ca8d9f4bc23b4d05fa8065804

SHA512
aa9b52717127d2a6ea41d20cbb0952fd25ed5c65cdd9d6881f496b41cf0b7b1688034a9352a544a89987630e9324ed3bb351527aeddaad622031c84603556aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-84DVQ.tmp\is-PVSOM.tmp

Filesize
572KB

MD5
6c771e6862cef3b18328bf5b6241c991

SHA1
655632265be57089137ed53960800e8089e3ceb9

SHA256
701b05147a5f39aba879e3fe136f10ff1399dc4ca8d9f4bc23b4d05fa8065804

SHA512
aa9b52717127d2a6ea41d20cbb0952fd25ed5c65cdd9d6881f496b41cf0b7b1688034a9352a544a89987630e9324ed3bb351527aeddaad622031c84603556aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jskBC5E.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
\Users\Admin\AppData\Local\Temp\is-84DVQ.tmp\is-PVSOM.tmp

Filesize
572KB

MD5
6c771e6862cef3b18328bf5b6241c991

SHA1
655632265be57089137ed53960800e8089e3ceb9

SHA256
701b05147a5f39aba879e3fe136f10ff1399dc4ca8d9f4bc23b4d05fa8065804

SHA512
aa9b52717127d2a6ea41d20cbb0952fd25ed5c65cdd9d6881f496b41cf0b7b1688034a9352a544a89987630e9324ed3bb351527aeddaad622031c84603556aa2

Download Submit
\Users\Admin\AppData\Local\Temp\is-A6K8C.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-A6K8C.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\jskBC5E.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
\Users\Admin\AppData\Local\Temp\jskBC5E.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/952-71-0x0000000000270000-0x00000000002E3000-memory.dmp

Filesize
460KB

Download
memory/1668-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1668-54-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1668-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1668-68-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1668-69-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1668-70-0x0000000000370000-0x00000000003E3000-memory.dmp

Filesize
460KB

Download
memory/1668-72-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1668-73-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1668-74-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1668-75-0x0000000000370000-0x00000000003E3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing