69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2

General

Target

69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
Size

1.4MB
MD5

cb4828efca437f8bf352cc5d22a327cb
SHA1

f2f247ddfc0a350644b4ceb3a05cd721cfbe69da
SHA256

69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2
SHA512

f3382fe4dbd824c016a226a2ddc1e28316ef555abe21a5eaf02690f9fe3223606c5f6782703e7ba53b2ae00b7789fa4ff3aacd60b81c74cd4bf8bde9692d773d
SSDEEP

24576:NMjhvUBW5udrz3Zd2+a0tD3kllm18p8AsOmDs1lKUTH7MGbER/QZJRPCjF1G:kMeErT7NaqCA2TVmA1lKU/MGbEZQdPCq

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e68-134.dat	acprotect
behavioral2/files/0x0006000000022e68-133.dat	acprotect
behavioral2/files/0x0006000000022e68-144.dat	acprotect
behavioral2/files/0x0006000000022e68-143.dat	acprotect
behavioral2/files/0x0006000000022e68-142.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4540	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Loads dropped DLL 4 IoCs

pid	Process
2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
4540	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp
4540	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4540	2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	82
PID 2796 wrote to memory of 4540	2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	82
PID 2796 wrote to memory of 4540	2796	69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe	82

C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe
"C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\is-UP0G3.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UP0G3.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp" /SL5="$80044,920915,140800,C:\Users\Admin\AppData\Local\Temp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-UP0G3.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UP0G3.tmp\69307d22ad12db033d940f7480f2cec0ca086fe473bc2f4c3ffe5476a9f9f8a2.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\uli71CA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uli71CA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uli71CA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uli71CA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uli71CA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/2796-135-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-138-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-137-0x00000000020F0000-0x0000000002163000-memory.dmp

Filesize
460KB

Download
memory/2796-132-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-146-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4540-139-0x0000000000000000-mapping.dmp

Download
memory/4540-145-0x00000000023F0000-0x0000000002463000-memory.dmp

Filesize
460KB

Download
memory/4540-147-0x00000000023F0000-0x0000000002463000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing