2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79

General

Target

2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
Size

1.7MB
MD5

75a581063d7ff02c5f5566a862aea3b1
SHA1

7c985fffba5fb5108b077b9c98f0771ecf7621ef
SHA256

2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79
SHA512

80f7f4463c913bb0951af0c75caf31094c7018358cb2f3fff795864eb07041a5ce56512e78e841c02b7546a69183d9d8c39879d72833a0acf6f0f6ca5c45bc39
SSDEEP

49152:Ghy8cBqP1vQ6lXaCSaSgp7HygaUpOGjkaN/3GlfS:G4yvQ69aCS27SgXAGjBn

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122f1-55.dat	acprotect
behavioral1/files/0x000b0000000122f1-69.dat	acprotect
behavioral1/files/0x000b0000000122f1-70.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
904	is-S2EDD.tmp

Loads dropped DLL 5 IoCs

pid	Process
1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
904	is-S2EDD.tmp
904	is-S2EDD.tmp
904	is-S2EDD.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28
PID 1680 wrote to memory of 904	1680	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	28

C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
"C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\is-P1SRT.tmp\is-S2EDD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P1SRT.tmp\is-S2EDD.tmp" /SL4 $80120 C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe 1353788 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ell762A.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P1SRT.tmp\is-S2EDD.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P1SRT.tmp\is-S2EDD.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
\Users\Admin\AppData\Local\Temp\ell762A.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\ell762A.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-55OFC.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-55OFC.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-P1SRT.tmp\is-S2EDD.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
memory/904-73-0x0000000000380000-0x00000000003F3000-memory.dmp

Filesize
460KB

Download
memory/1680-58-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1680-60-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1680-59-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download
memory/1680-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1680-57-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1680-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1680-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1680-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1680-74-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1680-75-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing