e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540

General

Target

e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe
Size

9.0MB
MD5

68eff28be2b38b97f6ebceee65a0dad8
SHA1

c3377535e545905d9c1c8e773b87f4e69909a5e6
SHA256

e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540
SHA512

fce14bd5e7444c155f11583cd11206646187d3e0db7192848f830a8b862b0c7d2aa1b4fbec34b27780fa369ff1e21cda0ce4a760202a5b1176a4e91c5c5b5ceb
SSDEEP

196608:amGx/yxOWRDK/8DKLS8eHzPDfRfRsuodnMW1utydAlcmCGd:xGto7OJmZrDNRsdnMopfGd

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a000000012708-54.dat	acprotect
behavioral1/files/0x000a000000012708-64.dat	acprotect
behavioral1/files/0x000a000000012708-65.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
832	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp

Loads dropped DLL 5 IoCs

pid	Process
1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe
1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe
832	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp
832	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp
832	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
832	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 832	1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe	28
PID 1356 wrote to memory of 832	1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe	28
PID 1356 wrote to memory of 832	1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe	28
PID 1356 wrote to memory of 832	1356	e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe	28

C:\Users\Admin\AppData\Local\Temp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe
"C:\Users\Admin\AppData\Local\Temp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\is-6OQ24.tmp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6OQ24.tmp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp" /SL5="$70124,8828276,126464,C:\Users\Admin\AppData\Local\Temp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6OQ24.tmp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp

Filesize
1.1MB

MD5
1f27a37b201efec064b5d8415ff9bdbc

SHA1
96c98a21341e6c402f518ca5dc51441237ec58a3

SHA256
dcce01b8258167e765e201fd953b47f31ce127e10ef0741f3fc069dd2fb38cd2

SHA512
1262d7a79d209f60be328eb902b9baf366688b07544fbbd64face6ca7d569aaeeb996b15c31b5da9226eadf1f5d8bb5a7477875408f5fd2f112c9f25c7c5cef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\orkAD8F.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-5JDMM.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-5JDMM.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-6OQ24.tmp\e2c2a75d73c4d93306e2f9a479d1957d4a4ac2a2556344df5169bcb317e7f540.tmp

Filesize
1.1MB

MD5
1f27a37b201efec064b5d8415ff9bdbc

SHA1
96c98a21341e6c402f518ca5dc51441237ec58a3

SHA256
dcce01b8258167e765e201fd953b47f31ce127e10ef0741f3fc069dd2fb38cd2

SHA512
1262d7a79d209f60be328eb902b9baf366688b07544fbbd64face6ca7d569aaeeb996b15c31b5da9226eadf1f5d8bb5a7477875408f5fd2f112c9f25c7c5cef9

Download Submit
\Users\Admin\AppData\Local\Temp\orkAD8F.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\orkAD8F.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/832-68-0x0000000000370000-0x00000000003E3000-memory.dmp

Filesize
460KB

Download
memory/832-70-0x0000000000370000-0x00000000003E3000-memory.dmp

Filesize
460KB

Download
memory/1356-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1356-58-0x00000000002E0000-0x0000000000353000-memory.dmp

Filesize
460KB

Download
memory/1356-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1356-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1356-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing