bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa

Analysis

max time kernel
71s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe
Size

10KB
MD5

061f6b7c2c943e5785ab3d9ffff5e875
SHA1

af042c7d828b7b5683818822c82783eeba02139b
SHA256

bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa
SHA512

23c939fc1acd1587d913b7bb5a95d48b46827c8b122d391d0db527e9aa6b69e4d7f138609762d979496094ffaa21026a5dd257564e9688909d117c5e54bea626
SSDEEP

192:fFRsiAOJKN13IzQZVW8HSR1d9+E3yGMudvqx622KIaP:zPKNLI1CE3y2EL21aP

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012304-57.dat	acprotect
behavioral1/files/0x000b000000012304-61.dat	acprotect
behavioral1/files/0x000b000000012304-60.dat	acprotect
behavioral1/files/0x000b000000012304-59.dat	acprotect
behavioral1/files/0x000b000000012304-58.dat	acprotect

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\inetx159.img	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe

Loads dropped DLL 4 IoCs

pid	Process
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntoskrnl.dll	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28
PID 700 wrote to memory of 1496	700	bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe	28

C:\Users\Admin\AppData\Local\Temp\bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe
"C:\Users\Admin\AppData\Local\Temp\bfcf43bc62fbb37fbd75a893299a4110840dc990c8f26de00930cb172d99edaa.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\ntoskrnl.dll , DllMain
  2⤵
  - Loads dropped DLL
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ntoskrnl.dll

Filesize
4KB

MD5
4dc55202e4cff2cde75adda67f85dde7

SHA1
d0d571cca6c2a8d005e4629967f5e98d357e9d89

SHA256
d112837ad1b015cf7bef6f2786d7df71e5f89b635b49068d1e8c4f8385abdaa2

SHA512
3d6a8e341e554a8f6a540cec110060edbdb84d49435fa0229ddf5dea9e0ca77372235998daefbef4ea589983f293d3cf65cf040c3f551840a986cd4f01ea6dff

Download Submit
\Windows\SysWOW64\ntoskrnl.dll

Filesize
4KB

MD5
4dc55202e4cff2cde75adda67f85dde7

SHA1
d0d571cca6c2a8d005e4629967f5e98d357e9d89

SHA256
d112837ad1b015cf7bef6f2786d7df71e5f89b635b49068d1e8c4f8385abdaa2

SHA512
3d6a8e341e554a8f6a540cec110060edbdb84d49435fa0229ddf5dea9e0ca77372235998daefbef4ea589983f293d3cf65cf040c3f551840a986cd4f01ea6dff

Download Submit
\Windows\SysWOW64\ntoskrnl.dll

Filesize
4KB

MD5
4dc55202e4cff2cde75adda67f85dde7

SHA1
d0d571cca6c2a8d005e4629967f5e98d357e9d89

SHA256
d112837ad1b015cf7bef6f2786d7df71e5f89b635b49068d1e8c4f8385abdaa2

SHA512
3d6a8e341e554a8f6a540cec110060edbdb84d49435fa0229ddf5dea9e0ca77372235998daefbef4ea589983f293d3cf65cf040c3f551840a986cd4f01ea6dff

Download Submit
\Windows\SysWOW64\ntoskrnl.dll

Filesize
4KB

MD5
4dc55202e4cff2cde75adda67f85dde7

SHA1
d0d571cca6c2a8d005e4629967f5e98d357e9d89

SHA256
d112837ad1b015cf7bef6f2786d7df71e5f89b635b49068d1e8c4f8385abdaa2

SHA512
3d6a8e341e554a8f6a540cec110060edbdb84d49435fa0229ddf5dea9e0ca77372235998daefbef4ea589983f293d3cf65cf040c3f551840a986cd4f01ea6dff

Download Submit
\Windows\SysWOW64\ntoskrnl.dll

Filesize
4KB

MD5
4dc55202e4cff2cde75adda67f85dde7

SHA1
d0d571cca6c2a8d005e4629967f5e98d357e9d89

SHA256
d112837ad1b015cf7bef6f2786d7df71e5f89b635b49068d1e8c4f8385abdaa2

SHA512
3d6a8e341e554a8f6a540cec110060edbdb84d49435fa0229ddf5dea9e0ca77372235998daefbef4ea589983f293d3cf65cf040c3f551840a986cd4f01ea6dff

Download Submit
memory/700-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1496-56-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download