69fecb8e2d73621e6f07206423838b46265a83298ff7b729f257aa78d707fa42

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SQLyog-12.0.8-0.x64.exe
Size

7.0MB
MD5

1b852158674e4aa895c46ee4ecc1a336
SHA1

4dc0b358639bba58b0d9275dac80b67fff98628b
SHA256

69fecb8e2d73621e6f07206423838b46265a83298ff7b729f257aa78d707fa42
SHA512

11b383d9396c4357a285304812caa3472fd921dc1859eb9c2773cf128c54127011760ae893d7913c85393f3720ccc311b16f39c21226fcab74a7d35bcc902e9f
SSDEEP

196608:kJqPbSAotXgGN4k1fWb+x4zomKDchPuwX9:EoeA2X/n167qDctp9

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000122e5-62.dat	acprotect

Loads dropped DLL 4 IoCs

pid	Process
2040	SQLyog-12.0.8-0.x64.exe
2040	SQLyog-12.0.8-0.x64.exe
2040	SQLyog-12.0.8-0.x64.exe
2040	SQLyog-12.0.8-0.x64.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000122e5-62.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	SQLyog-12.0.8-0.x64.exe

C:\Users\Admin\AppData\Local\Temp\SQLyog-12.0.8-0.x64.exe
"C:\Users\Admin\AppData\Local\Temp\SQLyog-12.0.8-0.x64.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\ioSpecial.ini

Filesize
711B

MD5
7a71a991179ef25715ecb6e4fcb10fb1

SHA1
187b011aa6cce99806a5ab6f47095395c50321d3

SHA256
fe5dfa788e25cee9635deb7f60af638d52658969f5849fb8a9825af049213a28

SHA512
4cb54f597d82c0ac4086320c10a9d91aec260a328466938ea02abf8d6600b204cbef5783f45b7fabef8739152110ba21efb73b540aacfaedfba3c69dd0d01936

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\ioSpecial.ini

Filesize
699B

MD5
c2d075438c27cb8b7fc623516221ad78

SHA1
313c1f043df9c11a86df530074bde4bcb8f33310

SHA256
56f368837b632f7b65badb9dee0a3bb2050d7f3619a901cf0b525844e4fd6ad5

SHA512
bb0953bd662ab1f80a36cfa339629dbed7081204d6096091ee157e7e2a1d584d4dcf51bff69b72c68e4176757310284e99c9d962bfee75d994419071c7e926fb

Download Submit
\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsiFEAB.tmp\version.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
memory/2040-69-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2040-147-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download