72c96f7e2f4823bb9f28944c96aa1b737be20edd52ca97b699085d3498e4ab74

Resubmissions

25/12/2022, 12:58

221225-p7wxwaef6w8

25/12/2022, 12:51

221225-p3w23sef6s8

25/12/2022, 12:47

221225-pz6r4sbe678

25/12/2022, 12:42

221225-pxdnjsbe668

Analysis

max time kernel
60s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2022, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ableton_KeyGen.exe
Size 1.1MB
Sample221225-pxdnjsbe66
SHA256 72c96f7e2f4823bb9f28944c96aa1b737be20edd52ca97b699085d3498e4ab74
MD5 5137f6c1b6fec54e3c4fce6261905dd6
SHA1 2acfa6961576086cb34376222cca49027b77871d
SHA512 762ccc51cb1f361ec9d44971015bfeef346f5dc0162d241f6e052bcd4ddb201655342fc21a3e8fe12243e678638e086f0c403eb01a6e52530f89f08f29e3e4a4
SSDEEP 24576:scLyLVBj7bonifxHi8nnM6+uRCy/4cZTKRZiKx9j1zp9KtyUHW:sAOsif1TMC1wcZTK+KZzxUHW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1576	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
1576	keygen.exe
1576	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	632	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1576	2312	Ableton_KeyGen.exe	82
PID 2312 wrote to memory of 1576	2312	Ableton_KeyGen.exe	82
PID 2312 wrote to memory of 1576	2312	Ableton_KeyGen.exe	82

C:\Users\Admin\AppData\Local\Temp\Ableton_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\Ableton_KeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

R2RLIVE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RLIVE.dll
Size 701KB
SHA256 33339fd831b14d39514593cf7494ba1985df6e32dbef166b70d94ebaad78cd3b
MD5 4ce264468be29f6504eb745d11aa1d5c
SHA1 072b84cbbdfa4ee945319dd338e171c2078df455
SHA512 e85885be024b39c6ebb1bc041fcce8545f6266fc26ebb1d2890e3c3a94d987397d67230634c3b973ed9e097ed591ba6577bb7f1cca50ffcd73564db04e3c1dbd
SSDEEP 12288:0UEARqlP7Vu7N8Oe/6Wi4MhgmIk2xxaoy9kFDH+AYrdshhunRgyGN/o9aWEnLiiG:0U9AlP7Qp8t/6WnCgTwrlRg1vLy2C
MD5 SHA1 SHA512 SSDEEP

Submit Download

R2RLIVE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RLIVE.dll
Size 701KB
SHA256 33339fd831b14d39514593cf7494ba1985df6e32dbef166b70d94ebaad78cd3b
MD5 4ce264468be29f6504eb745d11aa1d5c
SHA1 072b84cbbdfa4ee945319dd338e171c2078df455
SHA512 e85885be024b39c6ebb1bc041fcce8545f6266fc26ebb1d2890e3c3a94d987397d67230634c3b973ed9e097ed591ba6577bb7f1cca50ffcd73564db04e3c1dbd
SSDEEP 12288:0UEARqlP7Vu7N8Oe/6Wi4MhgmIk2xxaoy9kFDH+AYrdshhunRgyGN/o9aWEnLiiG:0U9AlP7Qp8t/6WnCgTwrlRg1vLy2C
MD5 SHA1 SHA512 SSDEEP

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 1.0MB
SHA256 9ae311e672f224a27350dd37cce871187377531741df048082b9cb680cd12882
MD5 eac249a6cbd92e5a744f1921261b4134
SHA1 3c1be061f209bf9cef151399f896a1e7927bb2cb
SHA512 3cdb465c746c816b5f9badbe10020a636aca694c1992e076cb251f81ba9cca158ba5455587d0bb966743b943ce88ad0c99c74d39664c55723e169d070a799459
SSDEEP 24576:njg85PbKWstZdIzNIPRnuEHDGLG5nyQweozKajh/q0nqVVjAsOktahU5F+eOohVz:njgcPuWs6zNIeLG5nyQweozKa1/q0nqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 469KB
SHA256 2ef24cb81741bcdcce8fdae0812ecb86a334b0a98160b4c068d2b59913c3896d
MD5 88fb2efaef130c7256bf703580a414a7
SHA1 e45068c6282ea2b279767be11dfe35767ec2f9f9
SHA512 33b5740b568a0c986ca15f6adc08a73e92269225f976776cf424d0e3cceac1eb89e0e26e58fbd3d25bac4ae31f4bc8b9d5a20c9c7c2808c2c24807120c62eb42
SSDEEP 6144:tPA4GcGvY6Q4rOQonRBVSszRNAOlsR1GGoIbqUJX8xrW3P0++:tpGVQ4KQonRBVrzRNC1v6kc++
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 469KB
SHA256 2ef24cb81741bcdcce8fdae0812ecb86a334b0a98160b4c068d2b59913c3896d
MD5 88fb2efaef130c7256bf703580a414a7
SHA1 e45068c6282ea2b279767be11dfe35767ec2f9f9
SHA512 33b5740b568a0c986ca15f6adc08a73e92269225f976776cf424d0e3cceac1eb89e0e26e58fbd3d25bac4ae31f4bc8b9d5a20c9c7c2808c2c24807120c62eb42
SSDEEP 6144:tPA4GcGvY6Q4rOQonRBVSszRNAOlsR1GGoIbqUJX8xrW3P0++:tpGVQ4KQonRBVrzRNC1v6kc++
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1576-139-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1576-141-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads