b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347

General

Target

b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
Size

1.7MB
MD5

9d6d9e0d7517f7c5d27fe0a0e4f90c4f
SHA1

137c8550dda310651301cd32301f9f6564c3291d
SHA256

b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347
SHA512

d32d5190845bcac7afa23f09c87fc010e0c692cc3522db65333ad77843264a5072981cc0283492e9377b48bb9b303d836fa03ec5f1f1895f17bca5163c9fda2b
SSDEEP

49152:b6d01H3V/M761xx2sY7/SXZHle/uw5YSDwktee6rznJqQ:+d01H3VaCx2sG/WZ9u3DwZbxZ

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000022f71-133.dat	acprotect
behavioral2/files/0x0009000000022f71-134.dat	acprotect
behavioral2/files/0x0009000000022f71-144.dat	acprotect
behavioral2/files/0x0009000000022f71-143.dat	acprotect
behavioral2/files/0x0009000000022f71-145.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5064	is-BKCOJ.tmp

Loads dropped DLL 4 IoCs

pid	Process
1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
5064	is-BKCOJ.tmp
5064	is-BKCOJ.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 5064	1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	79
PID 1092 wrote to memory of 5064	1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	79
PID 1092 wrote to memory of 5064	1092	b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe	79

C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe
"C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\is-M5UMP.tmp\is-BKCOJ.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M5UMP.tmp\is-BKCOJ.tmp" /SL4 $E0048 "C:\Users\Admin\AppData\Local\Temp\b02852e582474d958df6ff914fd398747c24fb03784d622bdac83dabb46d5347.exe" 1369898 57856
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-M5UMP.tmp\is-BKCOJ.tmp

Filesize
648KB

MD5
c3da2292c1d56912263fc895896c8ae7

SHA1
cd1b2ba93974cee23939afa5d026240c44dc171c

SHA256
ba19076706224da94a3ce18db0afcaec4f7f813a71fc51f47277f82f461b49e0

SHA512
0ac64d284d3d8531764e331d4c7297e3f6fda0c07ff8a2a3f8bb27bf2b3dba5590135051abf30f68c85855b47cdd7f0d94ae61fc4fe257c30e4153a7c7835a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M5UMP.tmp\is-BKCOJ.tmp

Filesize
648KB

MD5
c3da2292c1d56912263fc895896c8ae7

SHA1
cd1b2ba93974cee23939afa5d026240c44dc171c

SHA256
ba19076706224da94a3ce18db0afcaec4f7f813a71fc51f47277f82f461b49e0

SHA512
0ac64d284d3d8531764e331d4c7297e3f6fda0c07ff8a2a3f8bb27bf2b3dba5590135051abf30f68c85855b47cdd7f0d94ae61fc4fe257c30e4153a7c7835a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\xviD7F6.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\xviD7F6.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\xviD7F6.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\xviD7F6.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\xviD7F6.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1092-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1092-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1092-136-0x00000000021A0000-0x0000000002213000-memory.dmp

Filesize
460KB

Download
memory/1092-135-0x00000000021A0000-0x0000000002213000-memory.dmp

Filesize
460KB

Download
memory/1092-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1092-147-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1092-148-0x00000000021A0000-0x0000000002213000-memory.dmp

Filesize
460KB

Download
memory/5064-146-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download
memory/5064-149-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing