259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2022, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe
Size

250KB
MD5

b4a97d88cfffc4297243eb8cd788eb43
SHA1

3ba3316fbf6a98d790404a8d4146bb976c7edf19
SHA256

259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4
SHA512

888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3
SSDEEP

6144:4S2Pzdiift/xdCN5WiBbE0MMNCGDckVaWHxTPdSIDwC5jutrD:j2rHtJdQPdM3GAwzTIIDwC9utrD

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022e13-135.dat	acprotect
behavioral2/files/0x0007000000022e13-136.dat	acprotect
behavioral2/files/0x0007000000022e13-137.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3916	Au_.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e13-135.dat	upx
behavioral2/files/0x0007000000022e13-136.dat	upx
behavioral2/files/0x0007000000022e13-137.dat	upx
behavioral2/memory/3916-141-0x0000000074620000-0x00000000746B7000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
3916	Au_.exe
3916	Au_.exe
3916	Au_.exe
3916	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3916	4296	259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe	79
PID 4296 wrote to memory of 3916	4296	259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe	79
PID 4296 wrote to memory of 3916	4296	259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe	79

C:\Users\Admin\AppData\Local\Temp\259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe
"C:\Users\Admin\AppData\Local\Temp\259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

Filesize
181KB

MD5
327880d7f4a76ac165918770f8476a78

SHA1
cc6907b073e172419903173beddbc12d9ca7ca6a

SHA256
c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

SHA512
81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

Filesize
181KB

MD5
327880d7f4a76ac165918770f8476a78

SHA1
cc6907b073e172419903173beddbc12d9ca7ca6a

SHA256
c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

SHA512
81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

Filesize
181KB

MD5
327880d7f4a76ac165918770f8476a78

SHA1
cc6907b073e172419903173beddbc12d9ca7ca6a

SHA256
c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

SHA512
81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Filesize
250KB

MD5
b4a97d88cfffc4297243eb8cd788eb43

SHA1
3ba3316fbf6a98d790404a8d4146bb976c7edf19

SHA256
259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

SHA512
888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Filesize
250KB

MD5
b4a97d88cfffc4297243eb8cd788eb43

SHA1
3ba3316fbf6a98d790404a8d4146bb976c7edf19

SHA256
259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

SHA512
888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3

Download Submit
memory/3916-139-0x0000000074CC0000-0x0000000074D57000-memory.dmp

Filesize
604KB

Download
memory/3916-141-0x0000000074620000-0x00000000746B7000-memory.dmp

Filesize
604KB

Download
memory/3916-140-0x0000000074CC0000-0x0000000074D57000-memory.dmp

Filesize
604KB

Download
memory/3916-142-0x0000000074CC0000-0x0000000074D57000-memory.dmp

Filesize
604KB

Download
memory/3916-143-0x0000000074CC0000-0x0000000074D57000-memory.dmp

Filesize
604KB

Download