2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353

Analysis

max time kernel
146s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
Size

17.8MB
MD5

541c1ae225d8c394a34c3ae092300139
SHA1

3abffda166a2de105257327836f9258f8729acc1
SHA256

2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353
SHA512

92c6349feee6d952c8284741aca7cf5045fc3d4813fd59edb9161fe335c030fd6ce7a954b9513c6f628e043588908036ea8bcbede3d91827d7e1d21401a4d53d
SSDEEP

393216:4ET+xwnovgTgjCDblmaMD5K7yEPpiswoYvgzpxVEH:4ET6gTga6K7yEPsloWgzY

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022e2a-133.dat	acprotect
behavioral2/files/0x0007000000022e2a-134.dat	acprotect
behavioral2/files/0x0007000000022e2a-143.dat	acprotect
behavioral2/files/0x0007000000022e2a-142.dat	acprotect
behavioral2/files/0x0007000000022e2a-141.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2548	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Loads dropped DLL 6 IoCs

pid	Process
4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
2548	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
2548	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
2548	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
2548	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2548	4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	81
PID 4328 wrote to memory of 2548	4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	81
PID 4328 wrote to memory of 2548	4328	2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe	81

C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
"C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\is-BCT02.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BCT02.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp" /SL5="$801C4,18201819,56832,C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-BCT02.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Filesize
702KB

MD5
e470dc0989b8713ea215450228e0c714

SHA1
f2df3fd29919421a9f55f471d9fa70aea3751f59

SHA256
838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

SHA512
822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BCT02.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

Filesize
702KB

MD5
e470dc0989b8713ea215450228e0c714

SHA1
f2df3fd29919421a9f55f471d9fa70aea3751f59

SHA256
838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

SHA512
822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JSLI8.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JSLI8.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB5E7.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB5E7.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB5E7.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB5E7.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB5E7.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/2548-146-0x0000000003261000-0x0000000003263000-memory.dmp

Filesize
8KB

Download
memory/2548-148-0x0000000002290000-0x0000000002303000-memory.dmp

Filesize
460KB

Download
memory/2548-150-0x0000000002290000-0x0000000002303000-memory.dmp

Filesize
460KB

Download
memory/4328-136-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4328-132-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4328-135-0x0000000002040000-0x00000000020B3000-memory.dmp

Filesize
460KB

Download
memory/4328-147-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4328-149-0x0000000002040000-0x00000000020B3000-memory.dmp

Filesize
460KB

Download