b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347

General

Target

b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
Size

1.7MB
MD5

9d6d9e0d7517f7c5d27fe0a0e4f90c4f
SHA1

137c8550dda310651301cd32301f9f6564c3291d
SHA256

b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347
SHA512

d32d5190845bcac7afa23f09c87fc010e0c692cc3522db65333ad77843264a5072981cc0283492e9377b48bb9b303d836fa03ec5f1f1895f17bca5163c9fda2b
SSDEEP

49152:b6d01H3V/M761xx2sY7/SXZHle/uw5YSDwktee6rznJqQ:+d01H3VaCx2sG/WZ9u3DwZbxZ

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000005c50-55.dat	acprotect
behavioral1/files/0x0007000000005c50-68.dat	acprotect
behavioral1/files/0x0007000000005c50-67.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1792	is-SRHKB.tmp

Loads dropped DLL 5 IoCs

pid	Process
1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
1792	is-SRHKB.tmp
1792	is-SRHKB.tmp
1792	is-SRHKB.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27
PID 1148 wrote to memory of 1792	1148	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	27

C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
"C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\is-KMN6E.tmp\is-SRHKB.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KMN6E.tmp\is-SRHKB.tmp" /SL4 $A0022 "C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe" 1369898 57856
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-KMN6E.tmp\is-SRHKB.tmp

Filesize
648KB

MD5
c3da2292c1d56912263fc895896c8ae7

SHA1
cd1b2ba93974cee23939afa5d026240c44dc171c

SHA256
ba19076706224da94a3ce18db0afcaec4f7f813a71fc51f47277f82f461b49e0

SHA512
0ac64d284d3d8531764e331d4c7297e3f6fda0c07ff8a2a3f8bb27bf2b3dba5590135051abf30f68c85855b47cdd7f0d94ae61fc4fe257c30e4153a7c7835a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KMN6E.tmp\is-SRHKB.tmp

Filesize
648KB

MD5
c3da2292c1d56912263fc895896c8ae7

SHA1
cd1b2ba93974cee23939afa5d026240c44dc171c

SHA256
ba19076706224da94a3ce18db0afcaec4f7f813a71fc51f47277f82f461b49e0

SHA512
0ac64d284d3d8531764e331d4c7297e3f6fda0c07ff8a2a3f8bb27bf2b3dba5590135051abf30f68c85855b47cdd7f0d94ae61fc4fe257c30e4153a7c7835a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\ufk35D1.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-KMN6E.tmp\is-SRHKB.tmp

Filesize
648KB

MD5
c3da2292c1d56912263fc895896c8ae7

SHA1
cd1b2ba93974cee23939afa5d026240c44dc171c

SHA256
ba19076706224da94a3ce18db0afcaec4f7f813a71fc51f47277f82f461b49e0

SHA512
0ac64d284d3d8531764e331d4c7297e3f6fda0c07ff8a2a3f8bb27bf2b3dba5590135051abf30f68c85855b47cdd7f0d94ae61fc4fe257c30e4153a7c7835a21

Download Submit
\Users\Admin\AppData\Local\Temp\is-RENO6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-RENO6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\ufk35D1.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\ufk35D1.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1148-73-0x0000000000240000-0x0000000000255000-memory.dmp

Filesize
84KB

Download
memory/1148-60-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1148-58-0x0000000000240000-0x0000000000255000-memory.dmp

Filesize
84KB

Download
memory/1148-59-0x0000000000270000-0x00000000002E3000-memory.dmp

Filesize
460KB

Download
memory/1148-57-0x0000000000240000-0x0000000000255000-memory.dmp

Filesize
84KB

Download
memory/1148-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1148-69-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1148-74-0x0000000000270000-0x00000000002E3000-memory.dmp

Filesize
460KB

Download
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1792-70-0x0000000000350000-0x00000000003C3000-memory.dmp

Filesize
460KB

Download
memory/1792-75-0x0000000000350000-0x00000000003C3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing