2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79

General

Target

2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
Size

1.7MB
MD5

75a581063d7ff02c5f5566a862aea3b1
SHA1

7c985fffba5fb5108b077b9c98f0771ecf7621ef
SHA256

2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79
SHA512

80f7f4463c913bb0951af0c75caf31094c7018358cb2f3fff795864eb07041a5ce56512e78e841c02b7546a69183d9d8c39879d72833a0acf6f0f6ca5c45bc39
SSDEEP

49152:Ghy8cBqP1vQ6lXaCSaSgp7HygaUpOGjkaN/3GlfS:G4yvQ69aCS27SgXAGjBn

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0004000000022de2-132.dat	acprotect
behavioral2/files/0x0004000000022de2-133.dat	acprotect
behavioral2/files/0x0004000000022de2-142.dat	acprotect
behavioral2/files/0x0004000000022de2-143.dat	acprotect
behavioral2/files/0x0004000000022de2-144.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3068	is-LE2K4.tmp

Loads dropped DLL 4 IoCs

pid	Process
4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
3068	is-LE2K4.tmp
3068	is-LE2K4.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3068	4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	80
PID 4816 wrote to memory of 3068	4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	80
PID 4816 wrote to memory of 3068	4816	2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe	80

C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe
"C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\is-K6CER.tmp\is-LE2K4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K6CER.tmp\is-LE2K4.tmp" /SL4 $801C0 C:\Users\Admin\AppData\Local\Temp\2512b035d0730efa8570efd8a4f3c8c78628698ab13a1fe21c2141f0b71dff79.exe 1353788 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctiC316.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctiC316.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctiC316.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctiC316.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctiC316.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K6CER.tmp\is-LE2K4.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K6CER.tmp\is-LE2K4.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
memory/3068-145-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download
memory/3068-147-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download
memory/4816-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4816-137-0x00000000021E0000-0x0000000002253000-memory.dmp

Filesize
460KB

Download
memory/4816-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4816-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4816-146-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing