db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe
Size

948KB
MD5

355353edb91a75285daea27ee45d2a77
SHA1

8f438f4e84b63b0b84de0cd0894fa71e8358423b
SHA256

db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604
SHA512

f7ba2d8b0b1c6cff6d8de2b9b02d984a5116cdbf758730674561b479770df533146084710e05f7adca0671c4ea75417a0ab20197da1c48d7c792ce663f1a702e
SSDEEP

12288:Zgrykts3BqO0DoMOrGSYHcfLHDCCCkTanVQ4Bi5coaYui0HoYoVq:+mko0pmL6c7pTanVMcoLuTom

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\LIBEAY32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\SSLEAY32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\ssleay32.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

MailMagicLite.exe

pid process

5032 MailMagicLite.exe
Loads dropped DLL 4 IoCs

Processes:

MailMagicLite.exe

pid process

5032 MailMagicLite.exe
5032 MailMagicLite.exe
5032 MailMagicLite.exe
5032 MailMagicLite.exe

pid	process
5032	MailMagicLite.exe

pid	process
5032	MailMagicLite.exe
5032	MailMagicLite.exe
5032	MailMagicLite.exe
5032	MailMagicLite.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\LIBEAY32.dll	upx
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\SSLEAY32.dll	upx
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	upx
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	upx
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\ssleay32.dll	upx
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll	upx
behavioral2/memory/5032-146-0x0000000010000000-0x000000001002C000-memory.dmp	upx
behavioral2/memory/5032-147-0x0000000000A30000-0x0000000000B21000-memory.dmp	upx
behavioral2/memory/5032-148-0x0000000000A30000-0x0000000000B21000-memory.dmp	upx
behavioral2/memory/5032-150-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exeMailMagicLite.exe

pid process

748 db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe
5032 MailMagicLite.exe
5032 MailMagicLite.exe

pid	process
748	db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe
5032	MailMagicLite.exe
5032	MailMagicLite.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe

description	pid	process	target process
PID 748 wrote to memory of 5032	748	db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe	MailMagicLite.exe
PID 748 wrote to memory of 5032	748	db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe	MailMagicLite.exe
PID 748 wrote to memory of 5032	748	db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe	MailMagicLite.exe

C:\Users\Admin\AppData\Local\Temp\db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe
"C:\Users\Admin\AppData\Local\Temp\db6be7ac50662916c7339f018aca0fcb76d6bb1a50fd58695246145f2b1c3604.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\MailMagicLite.exe
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\MailMagicLite.exe C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\ChineseSimplified.ini
Filesize
33KB

MD5
98b5662486a5cba0f9f9eb173fe92c77

SHA1
9afaa104b2a98d2cf1af7b085f225a89cb05caf3

SHA256
475fdaaa0deed17cb4baf7aebbcc232f2ce98fc4def94e10cfc5a6b554b6514b

SHA512
d6e1ef5258755ec9ee012c0056a04336823661493b4f4d984ccba442821d22cd4754007399add3a96ddfcd42bd02072359e9e24546fbc0497e222a82e5e7089a

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\LIBEAY32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\MailMagicLite.exe
Filesize
332KB

MD5
b44a62174d245fbc75a6cd6a6c68d07c

SHA1
d23451df01d60f8612b5d02a6af7f0115e1a5067

SHA256
a381d03cc84272d59dc45b1457a65d57eebb30497aea6a2e0b5107850699668c

SHA512
43478e9f1917ec9b4b7389ef5e294891bfcce9ebd4187d7e1af6b98f67673e9cf4f76a6f75b248847cab277aaf923f89f6cef0d6aa61a267ad9b261300e61f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\MailMagicLite.exe
Filesize
332KB

MD5
b44a62174d245fbc75a6cd6a6c68d07c

SHA1
d23451df01d60f8612b5d02a6af7f0115e1a5067

SHA256
a381d03cc84272d59dc45b1457a65d57eebb30497aea6a2e0b5107850699668c

SHA512
43478e9f1917ec9b4b7389ef5e294891bfcce9ebd4187d7e1af6b98f67673e9cf4f76a6f75b248847cab277aaf923f89f6cef0d6aa61a267ad9b261300e61f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\SSLEAY32.dll
Filesize
66KB

MD5
0c29e546dbf1d3239f773bdd8cbd863c

SHA1
0d498107c1bc964cc399b1513e0bd9d9bf243de4

SHA256
0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

SHA512
aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\libeay32.dll
Filesize
364KB

MD5
dfd0a2b38848b849474f07e0cdc596b1

SHA1
6d5d3e3183dd391055263ac6ee19c9ac1281550d

SHA256
ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

SHA512
77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\61bba326-9562-436d-af76-665502d10801\ssleay32.dll
Filesize
66KB

MD5
0c29e546dbf1d3239f773bdd8cbd863c

SHA1
0d498107c1bc964cc399b1513e0bd9d9bf243de4

SHA256
0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

SHA512
aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

Download Submit
memory/5032-147-0x0000000000A30000-0x0000000000B21000-memory.dmp

Filesize
964KB

Download
memory/5032-148-0x0000000000A30000-0x0000000000B21000-memory.dmp

Filesize
964KB

Download
memory/5032-146-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/5032-150-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download