23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8

General

Target

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
Size

463KB
MD5

7418b76bbceb8bff0508e5ab40e397c4
SHA1

8b19e4edd153579dc6b35e02d31460d466a803e9
SHA256

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8
SHA512

45e15dc27bc92898bf93e94be81d421e6323b5eb54acb6a41d4475aaba80b83f533f5fc2789da0e36026f9b2f6e87348022eda8d4e687b9d5aa7fc3481ed66d0
SSDEEP

12288:fQMSdD5Pc4MsRqOJIIEJm92ANrjczcy2MT/YmTANSqit14F3SLzJEK8:fQMSdDaw0gZEJs2QC/TwYBqi34FKm

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\hideprocess.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\hideprocess.dll	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/540-133-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/540-134-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/540-135-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/2140-137-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/2140-140-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/540-138-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/2140-141-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe
behavioral2/memory/2140-143-0x0000000000050000-0x0000000000148000-memory.dmp	autoit_exe

Drops file in System32 directory 3 IoCs

Processes:

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hideprocess.dll	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
File opened for modification	C:\Windows\SysWOW64\hideprocess.dll	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
File opened for modification	C:\Windows\SysWOW64\hideprocess.dll	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

pid	process
2140	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
2140	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

description	pid	process	target process
PID 540 wrote to memory of 2140	540	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
PID 540 wrote to memory of 2140	540	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
PID 540 wrote to memory of 2140	540	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe	23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe

C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
"C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
"C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe" /ErrorStdOut
2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hideprocess.dll
Filesize
21KB

MD5
9858f738d68d5d0f055ba3d879348a5c

SHA1
8723520ff149161d0ebc1e8ce34efcae90a0a37b

SHA256
f2439030d186ba9f5ec6c3d484f3436ee2a2cc889a077a9c15a7650690498981

SHA512
61167a4ba5803aa8b96e75fcecdb19161a09e32fd01fd828ddd92e8e6c61c27d0be28ea00123d72b0562eafdc5440ae26be672a45276faa6a048ea813fdb8a39

Download Submit
memory/540-132-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/540-133-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/540-134-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/540-135-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/540-138-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/2140-136-0x0000000000000000-mapping.dmp

Download
memory/2140-137-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/2140-139-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/2140-140-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/2140-141-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download
memory/2140-143-0x0000000000050000-0x0000000000148000-memory.dmp

Filesize
992KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads