ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855

Analysis

max time kernel
142s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe
Size 103KB
Sample221207-azvmhscg2t
SHA256 ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855
MD5 cf8ee294799422b5eb407eaf7fd4e00b
SHA1 712ef3c27b9a0deb90f7e293f25aca345e878dfc
SHA512 986260fee6340f33871ed1a7448acf2aaf14c347f0670353f14a83b65342510ae4f98d5bdfbb602d53b8c89ea14b516d9b4d1cc6431d555a9bcd8edd16e152f6
SSDEEP 3072:IgXdZt9P6D3XJbCyKE3TyUxw+RZ8iGWrsYx:Ie344y33C+RZCi
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0004000000000727-133.dat	acprotect
behavioral2/files/0x0004000000000727-134.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000000727-133.dat	upx
behavioral2/files/0x0004000000000727-134.dat	upx
behavioral2/memory/3252-135-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3252	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4784	3252	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3252	4476	ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe	85
PID 4476 wrote to memory of 3252	4476	ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe	85
PID 4476 wrote to memory of 3252	4476	ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe	85

C:\Users\Admin\AppData\Local\Temp\ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe
"C:\Users\Admin\AppData\Local\Temp\ec9b499019512cabade9ae8f95a87f665e82396c5d218ea58f208f385b97c855.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\q_78fOsM.dll",Install C:\Users\Admin\AppData\Local\Temp\q_78fOsM
  2⤵
  - Loads dropped DLL
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 600
    3⤵
    - Program crash
    PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3252 -ip 3252
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

q_78fOsM.dll

Path C:\Users\Admin\AppData\Local\Temp\q_78fOsM.dll
Size 72KB
SHA256 17baf6a5a87009edaf25326892ac2f18c72955bce475349d85c2620237090cc6
MD5 da1c7313cf151c793c4b0156ea75ba8e
SHA1 ffa36f8a21183fdb5840c18aaac40251d02a4b34
SHA512 c2fc222c989e0822839e1dcf6a2d099a9d42fc6bdbc39577ec1bb4c43afc426cbdb322b0e59e1c963f66a3da8071c93ed0609969408d82bbd0a144614928d174
SSDEEP 1536:nU/UhP74lqGQFLaH66b4U/562IIYpoTDkZOE+u1bOb9:nU/UlCELGL6xIYpoTDfE/5g
MD5 SHA1 SHA512 SSDEEP

Submit Download