Overview

overview

9

Static

static

f2f957d64a...62.exe

windows7-x64

9

f2f957d64a...62.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f2f957d64aecd92e361fb9b69f1a0b6434fc6f9f944627d50d6a1a8ff73f6e62.exe

  • Size

    3.2MB

  • MD5

    70282aa9d117a5b3fb876e5c97ec39f7

  • SHA1

    4587cdf720c546d9346fb3a8dbd7f954697fd216

  • SHA256

    f2f957d64aecd92e361fb9b69f1a0b6434fc6f9f944627d50d6a1a8ff73f6e62

  • SHA512

    f9b32b518555e85b261e953f4c1543822ee67c47723d33c6b02f8dc37892be2578f41143d4cc51e764a1628db87e0d01f0f4bdf027f33b56b5d8e2756f00aa70

  • SSDEEP

    98304:BBI6dlG4FWZYqdwkLcHHV24PXbG38ZkeJZ8U7Si+3mV3oS/z:F6jAM4PZHmZ2oMz

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2f957d64aecd92e361fb9b69f1a0b6434fc6f9f944627d50d6a1a8ff73f6e62.exe
    "C:\Users\Admin\AppData\Local\Temp\f2f957d64aecd92e361fb9b69f1a0b6434fc6f9f944627d50d6a1a8ff73f6e62.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1184

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\SkinH_EL.dll
          Filesize

          86KB

          MD5

          147127382e001f495d1842ee7a9e7912

          SHA1

          92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

          SHA256

          edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

          SHA512

          97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

          Download Submit

        • memory/1184-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1184-56-0x0000000000400000-0x000000000072D000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/1184-57-0x0000000010000000-0x000000001003D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/1184-58-0x0000000000400000-0x000000000072D000-memory.dmp

          Filesize

          3.2MB

          Download