41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe

General

Target

41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
Size

3.1MB
MD5

9e3f049cc82eeeac401e7eb3534be080
SHA1

786cccffef50cd3eb0e837120bcde65fc5d519b7
SHA256

41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe
SHA512

78eef3745b6b41d22e5c99700e45c6a2ce4fbf8f461113d037e01de91217002cc68c1264a729a303be97e7a45afaec24fcf69e5f1f13462a4c960189c0b0e72b
SSDEEP

49152:yEO3FfNhG/Y9gEkFW+i9F5lEO6EgFqh1WshKNhuNPvrMVmzjzFN8VXfjR/0D30Na:UVLgBC9rl/GIRKNLVoz8ZrRs7xaZPgn

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0003000000022dd4-134.dat	acprotect
behavioral2/files/0x0003000000022dd4-133.dat	acprotect
behavioral2/files/0x0003000000022dd4-142.dat	acprotect
behavioral2/files/0x0003000000022dd4-144.dat	acprotect
behavioral2/files/0x0003000000022dd4-143.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
544	is-56CQS.tmp

Loads dropped DLL 4 IoCs

pid	Process
5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
544	is-56CQS.tmp
544	is-56CQS.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 544	5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	81
PID 5036 wrote to memory of 544	5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	81
PID 5036 wrote to memory of 544	5036	41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe	81

C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe
"C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\is-QMRD3.tmp\is-56CQS.tmp
  C:\Users\Admin\AppData\Local\Temp\is-QMRD3.tmp\is-56CQS.tmp /SL4 $70034 C:\Users\Admin\AppData\Local\Temp\41b4402ba8ba4ecfd77feedb299e853d3de920390be1151bb72a46c3260e6dbe.exe 3081042 68096
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htiC74C.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\htiC74C.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\htiC74C.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\htiC74C.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\htiC74C.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QMRD3.tmp\is-56CQS.tmp

Filesize
542KB

MD5
7f89ee4b959ddc9eb34d3db7196c9537

SHA1
d8f8939a39dd4294c04532fc730398b51434f9c9

SHA256
a6e5c93270dc4826d66d00ef5729b0ecfe43fa9250f861f464a071d3915ceb05

SHA512
0f40ea85a7a1add8966fa8e6a20420569626107c65667d8bdd7e497c9e437e861fbc468d9405e048e843fe255bc104b2dbceb6cfcdb0767e306f93b17c8d3141

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QMRD3.tmp\is-56CQS.tmp

Filesize
542KB

MD5
7f89ee4b959ddc9eb34d3db7196c9537

SHA1
d8f8939a39dd4294c04532fc730398b51434f9c9

SHA256
a6e5c93270dc4826d66d00ef5729b0ecfe43fa9250f861f464a071d3915ceb05

SHA512
0f40ea85a7a1add8966fa8e6a20420569626107c65667d8bdd7e497c9e437e861fbc468d9405e048e843fe255bc104b2dbceb6cfcdb0767e306f93b17c8d3141

Download Submit
memory/544-145-0x0000000002470000-0x00000000024E3000-memory.dmp

Filesize
460KB

Download
memory/544-147-0x0000000002470000-0x00000000024E3000-memory.dmp

Filesize
460KB

Download
memory/5036-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5036-138-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5036-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5036-135-0x00000000021E0000-0x0000000002253000-memory.dmp

Filesize
460KB

Download
memory/5036-146-0x00000000021E0000-0x0000000002253000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing