8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd

Analysis

max time kernel
141s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe
Size

948KB
MD5

1ad9c1ef92621d3580f520fa11560e7a
SHA1

610f123ff8567cb2e1cf084f1777a18bb47bdecc
SHA256

8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd
SHA512

e70535ced4407bbd4b2520133d9fe283686df10e00dfdd4e7a02fc2c104fb0f5927a0a71584468fa7b57ab2c472cb3b21867ccea69c6af0509d86f42659217ba
SSDEEP

12288:Zgrykts3BqO0DoMOrGSYHcfLHDCCCkTanVQ4BiwcoaYui0HoYoV8P:+mko0pmL6c7pTanVFcoLuTowP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\SSLEAY32.dll	acprotect
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\ssleay32.dll	acprotect
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\libeay32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\LIBEAY32.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

MailMagicLite.exe

pid process

832 MailMagicLite.exe

pid	process
832	MailMagicLite.exe

Loads dropped DLL 4 IoCs

Processes:

8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exeMailMagicLite.exe

pid	process
1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe
1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe
832	MailMagicLite.exe
832	MailMagicLite.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\SSLEAY32.dll	upx
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\ssleay32.dll	upx
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\libeay32.dll	upx
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\LIBEAY32.dll	upx
behavioral1/memory/832-70-0x0000000010000000-0x000000001002C000-memory.dmp	upx
behavioral1/memory/832-71-0x00000000002B0000-0x00000000003A1000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exeMailMagicLite.exe

pid process

1484 8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe
832 MailMagicLite.exe
832 MailMagicLite.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe

description	pid	process	target process
PID 1484 wrote to memory of 832	1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe	MailMagicLite.exe
PID 1484 wrote to memory of 832	1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe	MailMagicLite.exe
PID 1484 wrote to memory of 832	1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe	MailMagicLite.exe
PID 1484 wrote to memory of 832	1484	8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe	MailMagicLite.exe

C:\Users\Admin\AppData\Local\Temp\8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe
"C:\Users\Admin\AppData\Local\Temp\8f89a0ad10a7ba2330613217aa4b4c50beac189cc35582a6e3ce8930731529dd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484

C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:832

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\ChineseSimplified.ini
Filesize
33KB

MD5
98b5662486a5cba0f9f9eb173fe92c77

SHA1
9afaa104b2a98d2cf1af7b085f225a89cb05caf3

SHA256
475fdaaa0deed17cb4baf7aebbcc232f2ce98fc4def94e10cfc5a6b554b6514b

SHA512
d6e1ef5258755ec9ee012c0056a04336823661493b4f4d984ccba442821d22cd4754007399add3a96ddfcd42bd02072359e9e24546fbc0497e222a82e5e7089a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\LIBEAY32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe
Filesize
332KB

MD5
aefc3b78d4aadbcb374d8fe58681093a

SHA1
288af1514a5c204f57a2b8f8480f3e9353719912

SHA256
7af5852251e7c2bb92a4323e9fcffbfa86fbf45e538faebee21a09c2202cadab

SHA512
c3a47577dfe3367fcdd61fee5ed08a7627f00cbcfa6ca38f12df0fb50208b7179f72f4aaf2b532fffde3c7001634bcd20a2009382427c83d725e0ab5eee275b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe
Filesize
332KB

MD5
aefc3b78d4aadbcb374d8fe58681093a

SHA1
288af1514a5c204f57a2b8f8480f3e9353719912

SHA256
7af5852251e7c2bb92a4323e9fcffbfa86fbf45e538faebee21a09c2202cadab

SHA512
c3a47577dfe3367fcdd61fee5ed08a7627f00cbcfa6ca38f12df0fb50208b7179f72f4aaf2b532fffde3c7001634bcd20a2009382427c83d725e0ab5eee275b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\SSLEAY32.dll
Filesize
66KB

MD5
0c29e546dbf1d3239f773bdd8cbd863c

SHA1
0d498107c1bc964cc399b1513e0bd9d9bf243de4

SHA256
0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

SHA512
aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

Download Submit
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe
Filesize
332KB

MD5
aefc3b78d4aadbcb374d8fe58681093a

SHA1
288af1514a5c204f57a2b8f8480f3e9353719912

SHA256
7af5852251e7c2bb92a4323e9fcffbfa86fbf45e538faebee21a09c2202cadab

SHA512
c3a47577dfe3367fcdd61fee5ed08a7627f00cbcfa6ca38f12df0fb50208b7179f72f4aaf2b532fffde3c7001634bcd20a2009382427c83d725e0ab5eee275b5

Download Submit
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\MailMagicLite.exe
Filesize
332KB

MD5
aefc3b78d4aadbcb374d8fe58681093a

SHA1
288af1514a5c204f57a2b8f8480f3e9353719912

SHA256
7af5852251e7c2bb92a4323e9fcffbfa86fbf45e538faebee21a09c2202cadab

SHA512
c3a47577dfe3367fcdd61fee5ed08a7627f00cbcfa6ca38f12df0fb50208b7179f72f4aaf2b532fffde3c7001634bcd20a2009382427c83d725e0ab5eee275b5

Download Submit
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\libeay32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
\Users\Admin\AppData\Local\Temp\5e32a1b1-befd-4e32-bbfa-7a4b61d24262\ssleay32.dll
Filesize
66KB

MD5
0c29e546dbf1d3239f773bdd8cbd863c

SHA1
0d498107c1bc964cc399b1513e0bd9d9bf243de4

SHA256
0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

SHA512
aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

Download Submit
memory/832-70-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/832-71-0x00000000002B0000-0x00000000003A1000-memory.dmp

Filesize
964KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads