ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb

Analysis

max time kernel
173s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe
Size

900KB
MD5

87b31cfb958679cddf4c15f7d26f97f2
SHA1

f71ea6d4d08aabd14cd57af1edf0ac2ebdf4c7db
SHA256

ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb
SHA512

f9732fc4b2326ab6121ca133dc90056980d07020ac8e447bce2d9628f704fd28431e490203b38e54a47fc83975faadf61f4832c9a5e784e3888046e40d2741eb
SSDEEP

24576:O5dSg7Nk8CaFxAyiD6FK00jkOZN845VGnFyDC:I9AyDF/0jkaN8iyFye

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000022dd1-132.dat	acprotect
behavioral2/files/0x0009000000022dd1-133.dat	acprotect
behavioral2/files/0x0009000000022dd1-140.dat	acprotect
behavioral2/files/0x0009000000022dd1-141.dat	acprotect
behavioral2/files/0x0009000000022dd1-139.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
224	is-0GV3L.tmp

Loads dropped DLL 6 IoCs

pid	Process
1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe
1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe
224	is-0GV3L.tmp
224	is-0GV3L.tmp
224	is-0GV3L.tmp
224	is-0GV3L.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 224	1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe	82
PID 1364 wrote to memory of 224	1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe	82
PID 1364 wrote to memory of 224	1364	ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe	82

C:\Users\Admin\AppData\Local\Temp\ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe
"C:\Users\Admin\AppData\Local\Temp\ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\is-GSHHB.tmp\is-0GV3L.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GSHHB.tmp\is-0GV3L.tmp" /SL4 $70090 C:\Users\Admin\AppData\Local\Temp\ebc783b509251a2b3a286257d732e699e592f8ea9455792a50a831739b7d7aeb.exe 511279 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9OFNP.tmp\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9OFNP.tmp\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GSHHB.tmp\is-0GV3L.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GSHHB.tmp\is-0GV3L.tmp

Filesize
588KB

MD5
ada0596f481e037ab4eb86fcb10e827e

SHA1
ef03245a6479799c3946b5cee16ef1dd72c46a8d

SHA256
cf66bee55697b7bab60bdf17898af35528887ebc916a12c3510189629bf17967

SHA512
1fe891effa732e37ec997894fddb847553e83a64dccf650fa00ab95027f52b2845b318dc836e5487835c4da18559c1de6731af592f81a39f80dd23ef2111ac88

Download Submit
C:\Users\Admin\AppData\Local\Temp\uei2AC9.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\uei2AC9.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\uei2AC9.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\uei2AC9.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\uei2AC9.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
memory/224-144-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/224-147-0x0000000002391000-0x0000000002395000-memory.dmp

Filesize
16KB

Download
memory/224-136-0x0000000000000000-mapping.dmp

Download
memory/224-148-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/1364-142-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1364-143-0x0000000002040000-0x00000000020B4000-memory.dmp

Filesize
464KB

Download
memory/1364-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download