41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe

General

Target

41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
Size

3.1MB
MD5

9e3f049cc82eeeac401e7eb3534be080
SHA1

786cccffef50cd3eb0e837120bcde65fc5d519b7
SHA256

41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe
SHA512

78eef3745b6b41d22e5c99700e45c6a2ce4fbf8f461113d037e01de91217002cc68c1264a729a303be97e7a45afaec24fcf69e5f1f13462a4c960189c0b0e72b
SSDEEP

49152:yEO3FfNhG/Y9gEkFW+i9F5lEO6EgFqh1WshKNhuNPvrMVmzjzFN8VXfjR/0D30Na:UVLgBC9rl/GIRKNLVoz8ZrRs7xaZPgn

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122f1-55.dat	acprotect
behavioral1/files/0x000b0000000122f1-68.dat	acprotect
behavioral1/files/0x000b0000000122f1-69.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1464	is-PA7SF.tmp

Loads dropped DLL 5 IoCs

pid	Process
668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
1464	is-PA7SF.tmp
1464	is-PA7SF.tmp
1464	is-PA7SF.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28
PID 668 wrote to memory of 1464	668	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	28

C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
"C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\is-LDCQQ.tmp\is-PA7SF.tmp
  C:\Users\Admin\AppData\Local\Temp\is-LDCQQ.tmp\is-PA7SF.tmp /SL4 $C0122 C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe 3081042 68096
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ikl6559.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LDCQQ.tmp\is-PA7SF.tmp

Filesize
542KB

MD5
7f89ee4b959ddc9eb34d3db7196c9537

SHA1
d8f8939a39dd4294c04532fc730398b51434f9c9

SHA256
a6e5c93270dc4826d66d00ef5729b0ecfe43fa9250f861f464a071d3915ceb05

SHA512
0f40ea85a7a1add8966fa8e6a20420569626107c65667d8bdd7e497c9e437e861fbc468d9405e048e843fe255bc104b2dbceb6cfcdb0767e306f93b17c8d3141

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LDCQQ.tmp\is-PA7SF.tmp

Filesize
542KB

MD5
7f89ee4b959ddc9eb34d3db7196c9537

SHA1
d8f8939a39dd4294c04532fc730398b51434f9c9

SHA256
a6e5c93270dc4826d66d00ef5729b0ecfe43fa9250f861f464a071d3915ceb05

SHA512
0f40ea85a7a1add8966fa8e6a20420569626107c65667d8bdd7e497c9e437e861fbc468d9405e048e843fe255bc104b2dbceb6cfcdb0767e306f93b17c8d3141

Download Submit
\Users\Admin\AppData\Local\Temp\ikl6559.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
\Users\Admin\AppData\Local\Temp\ikl6559.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
\Users\Admin\AppData\Local\Temp\is-GU8UN.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-GU8UN.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-LDCQQ.tmp\is-PA7SF.tmp

Filesize
542KB

MD5
7f89ee4b959ddc9eb34d3db7196c9537

SHA1
d8f8939a39dd4294c04532fc730398b51434f9c9

SHA256
a6e5c93270dc4826d66d00ef5729b0ecfe43fa9250f861f464a071d3915ceb05

SHA512
0f40ea85a7a1add8966fa8e6a20420569626107c65667d8bdd7e497c9e437e861fbc468d9405e048e843fe255bc104b2dbceb6cfcdb0767e306f93b17c8d3141

Download Submit
memory/668-58-0x0000000000020000-0x0000000000039000-memory.dmp

Filesize
100KB

Download
memory/668-63-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/668-60-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/668-59-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download
memory/668-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/668-57-0x0000000000020000-0x0000000000039000-memory.dmp

Filesize
100KB

Download
memory/668-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/668-73-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download
memory/1464-70-0x00000000004A0000-0x0000000000513000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing