69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2

General

Target

69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
Size

1.4MB
MD5

cb4828efca437f8bf352cc5d22a327cb
SHA1

f2f247ddfc0a350644b4ceb3a05cd721cfbe69da
SHA256

69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2
SHA512

f3382fe4dbd824c016a226a2ddc1e28316ef555abe21a5eaf02690f9fe3223606c5f6782703e7ba53b2ae00b7789fa4ff3aacd60b81c74cd4bf8bde9692d773d
SSDEEP

24576:NMjhvUBW5udrz3Zd2+a0tD3kllm18p8AsOmDs1lKUTH7MGbER/QZJRPCjF1G:kMeErT7NaqCA2TVmA1lKU/MGbEZQdPCq

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000000b2d2-54.dat	acprotect
behavioral1/files/0x000500000000b2d2-63.dat	acprotect
behavioral1/files/0x000500000000b2d2-62.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
844	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Loads dropped DLL 5 IoCs

pid	Process
1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
844	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp
844	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp
844	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27
PID 1724 wrote to memory of 844	1724	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	27

C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
"C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\is-A6E1R.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A6E1R.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp" /SL5="$70124,920915,140800,C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iak252.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A6E1R.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
\Users\Admin\AppData\Local\Temp\iak252.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\iak252.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-A6E1R.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
\Users\Admin\AppData\Local\Temp\is-BHTBQ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-BHTBQ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/844-59-0x0000000000000000-mapping.dmp

Download
memory/844-68-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download
memory/1724-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1724-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1724-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1724-67-0x0000000001C10000-0x0000000001C83000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing