2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353

General

Target

2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
Size

17.8MB
MD5

541c1ae225d8c394a34c3ae092300139
SHA1

3abffda166a2de105257327836f9258f8729acc1
SHA256

2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353
SHA512

92c6349feee6d952c8284741aca7cf5045fc3d4813fd59edb9161fe335c030fd6ce7a954b9513c6f628e043588908036ea8bcbede3d91827d7e1d21401a4d53d
SSDEEP

393216:4ET+xwnovgTgjCDblmaMD5K7yEPpiswoYvgzpxVEH:4ET6gTga6K7yEPsloWgzY

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000141fc-54.dat	acprotect
behavioral1/files/0x00090000000141fc-65.dat	acprotect
behavioral1/files/0x00090000000141fc-66.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Loads dropped DLL 6 IoCs

pid	Process
1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
596	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 596	1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	28
PID 1528 wrote to memory of 596	1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	28
PID 1528 wrote to memory of 596	1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	28
PID 1528 wrote to memory of 596	1528	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	28

C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
"C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp" /SL5="$80124,18201819,56832,C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Filesize
702KB

MD5
e470dc0989b8713ea215450228e0c714

SHA1
f2df3fd29919421a9f55f471d9fa70aea3751f59

SHA256
838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

SHA512
822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nnk898B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Filesize
702KB

MD5
e470dc0989b8713ea215450228e0c714

SHA1
f2df3fd29919421a9f55f471d9fa70aea3751f59

SHA256
838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

SHA512
822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

Download Submit
\Users\Admin\AppData\Local\Temp\nnk898B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\nnk898B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/596-70-0x0000000001ED0000-0x0000000001F43000-memory.dmp

Filesize
460KB

Download
memory/1528-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1528-58-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1528-59-0x0000000000360000-0x00000000003D3000-memory.dmp

Filesize
460KB

Download
memory/1528-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1528-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1528-71-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing