21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c

Analysis

max time kernel
61s
max time network
100s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
Size

4.5MB
MD5

ff2c0b2b8c3da728a991d740c443f091
SHA1

86c6ebdc06cb0f7bb57730e617743fbb09838f5b
SHA256

21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c
SHA512

e795b8cacb9ddc69c7abb3afa1b58db933c6d1caa65028e1218321ee80be0dd6a5c8cf9d4d18165a0e7bf29cf9a7d34e543a4d5421cdb4f250d9441963a65a36
SSDEEP

98304:MxA12ahMqaAsUhpubzfo9UtUXmRrzyFi51O12p:MxWh04Pubzg94VuAPL

Score

9^/10

discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012302-56.dat	acprotect
behavioral1/memory/908-57-0x00000000003B0000-0x00000000003BC000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012302-56.dat	upx
behavioral1/memory/908-57-0x00000000003B0000-0x00000000003BC000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
908	21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe

C:\Users\Admin\AppData\Local\Temp\21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe
"C:\Users\Admin\AppData\Local\Temp\21d4eb5194c77b1f67f4ae73b6299dd4b31702a0c475ad371ecd15d560cffc6c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjB9C0.tmp\Helper.dll

Filesize
1.3MB

MD5
6638890dd79ae7d7f3e7f0a6b84b166c

SHA1
493377cf64dcbea4d8d72ee9fcc27f77ec3d2dda

SHA256
42355ee8537d70ec910a86ff0eea31a7eac7b654e95bd9383b76e3309536107f

SHA512
1dd42bb171a1dda4cf3a4859c51d140d8e5bd930098a7c359e0d2a6cc5dd23823babf5f191510aa07a32a3fa6abf2826e1b619fc14c21037124dc6ca80847e13

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB9C0.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB9C0.tmp\nsDialogs.dll

Filesize
9KB

MD5
ab73c0c2a23f913eabdc4cb24b75cbad

SHA1
6569d2863d54c88dcf57c843fc310f6d9571a41e

SHA256
3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

SHA512
99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB9C0.tmp\versionex.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
memory/908-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/908-57-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/908-58-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download