e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10

Analysis

max time kernel
136s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe
Size

74KB
MD5

69405c8bdce4acc2b8208c6c0b99c36e
SHA1

a82d5688165d48209eb5428055207119b7a34945
SHA256

e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10
SHA512

51f8e5b3f531260561ae99a8a5b8a34de953dd73239deea7cb482aea2da13be465a6195b13656f2946252e4b6af4f6e9aa4c50e41c04236e41f638128b324a0f
SSDEEP

1536:BpgpHzb9dZVX9fHMvG0D3XJK8vN84TbGxkqIzjbanyr:7gXdZt9P6D3XJdlc5KB

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022e2b-136.dat	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022e2b-136.dat	upx

Loads dropped DLL 4 IoCs

pid	Process
3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe
3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe
3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe
3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 2140	3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2140	3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe	81
PID 3760 wrote to memory of 2140	3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe	81
PID 3760 wrote to memory of 2140	3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe	81
PID 3760 wrote to memory of 2140	3760	e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe	81

C:\Users\Admin\AppData\Local\Temp\e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe
"C:\Users\Admin\AppData\Local\Temp\e02e5a9103b911961f66e6233a5984271d55cf4ad3410a58394fca5fb26aab10.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsqB173.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqB173.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqB173.tmp\SelfDel.dll

Filesize
4KB

MD5
7cff7fe2caea5184d98c147e7e263132

SHA1
21f39d3d0dd5f7198d67ef30e95d10ae3460093e

SHA256
281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101

SHA512
fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqB173.tmp\UAC.dll

Filesize
13KB

MD5
431e5b960aa15af5d153bae6ba6b7e87

SHA1
e090c90be02e0bafe5f3d884c0525d8f87b3db40

SHA256
a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13

SHA512
f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8

Download Submit
memory/3760-135-0x0000000002A51000-0x0000000002A54000-memory.dmp

Filesize
12KB

Download