305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83

General

Target

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
Size

1.8MB
MD5

22e37a07e0e66715109a8aee71d6c21b
SHA1

ed85ea1ac4f54c3c1400e3741189f8b2c2e5309f
SHA256

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83
SHA512

0a64b052a2d48132f52b25a8202e6a48aa936a8d7be991c76cdae0be178385ba5c202b569fa5e67e2489ff3279806dc1a65953bbd781101e9a7613344b096582
SSDEEP

49152:VSBeCTBg/nYFBE4Lwl7mCfpweTsYfOJBW+VPb:VuTkYFm4Lwl7mKmEskozPb

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\libeay32.dll	acprotect
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\ssleay32.dll	acprotect

Loads dropped DLL 2 IoCs

Processes:

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

pid	process
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\libeay32.dll	upx
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\ssleay32.dll	upx
behavioral2/memory/1072-164-0x0000000011000000-0x0000000011179000-memory.dmp	upx
behavioral2/memory/1072-165-0x0000000012000000-0x000000001205F000-memory.dmp	upx
behavioral2/memory/1072-200-0x0000000011000000-0x0000000011179000-memory.dmp	upx
behavioral2/memory/1072-201-0x0000000012000000-0x000000001205F000-memory.dmp	upx
behavioral2/memory/1072-207-0x0000000011000000-0x0000000011179000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

pid	process
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

pid	process
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

pid	process
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

pid	process
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
1072	305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe

C:\Users\Admin\AppData\Local\Temp\305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe
"C:\Users\Admin\AppData\Local\Temp\305f27e9064b4ebb4738dd644a2686f623a02d067b7c2e78ed54d64332b3ee83.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\user.dat.tmp
Filesize
35B

MD5
7676c40a3b8254c29b2028110b749daa

SHA1
c3104df46101e6381aa93144d6413b05d89bf25c

SHA256
92ab4b13e2c39a1ddf7ba59db932def3a3efd43ce63b469cd6b1c08d0853fc28

SHA512
c35ef0c1b54d3b3ab264ef52bc1e78fa4674430b3f705724f8de472cfeed3e382a6e5959a1119858e5f9a41618ad6bebc5af52df8250c00eefeb704ac8138dc2

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\NCaddon.xml
Filesize
20KB

MD5
d81614bb7fb14af10dbc333ecc2ae5c5

SHA1
4e7f5d989e991da45b22b85e25f0b9cdfd21d2ab

SHA256
165a9f7beeb4010f85f794bcb6f4931c2e3cbc8282be885057de883e674ba42e

SHA512
36f099c701e0f5ad356009835a3d4f971ae3d13864c0aab299a5755d546d17e1924604ff5eb9dbd938e046e0595ab2c964719dccb245fb17f3d8fcb7779c47ef

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\NCload_main.xml
Filesize
2KB

MD5
8b9cbaee9234c10a9f1deef7c51fbf38

SHA1
bde1cdf818a4445700f045f0a5808e57706e672b

SHA256
69f51c5f1e1102d7d0f1aa3acf7b69e8586660021e461d67651261f7c05299da

SHA512
d7b9a13f1c13950db102688cc0db796fecb155d9ab803993d02805412c154cfa86a4bfbc00ebe384649912aaff79c16184783beca4ae27ac7a1e06b4c2906aa9

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\activity.xml
Filesize
38KB

MD5
01c471c9192f84bb86073a5e06e0e760

SHA1
355af37c254e820ce6ed9c620b719ea7c0505b96

SHA256
09765185ede59930a01b33d7c62b7557f717a4fa7b089b93b632ee009601fc2e

SHA512
81536f0eeaac9893e1bd5d6f9b518473b65bb12ad768f83576a76167812f8bf19dafff8f6ac74f679bd6ca507fda45f797bb71cbd2f2ec0964030d4157dae0a1

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\crop.xml
Filesize
2.5MB

MD5
e59a1bc1cd90fd0867ebd4344ce553ee

SHA1
aea2f2b18a611e9f911bb8406a7f3c9709627d31

SHA256
aeecb43355f0c1cace9abb776da17bf0db65a9557c08c886208e1cbb4b20e450

SHA512
8360a2ec7f15778515192d94ebba681087d5c7fc2dfa0b570438d9532c5dc27201ba39da12c931697d2848cf36ad866546acb4a3c306025858ee6d87bc3a6c62

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\libeay32.dll
Filesize
558KB

MD5
5f86d65a1686e6bb031048d04bb3fe04

SHA1
08052c7dda12c53971dd5600223cfb3a47283998

SHA256
39531152d763dd51da8ae6a50b206f296a07410602cdb399c991987e8a11f6b4

SHA512
970e9965236cfb827848e93de3ad0132cde0a57cbee38ad72441dc65fb824ea6c749e5993cd948231bb881d4cf6dfc735231b643d58b64de1f81caff91987e5b

Download Submit
C:\Users\Admin\Documents\QQÅ©ÄÁÖúÊÖ\xml\ssleay32.dll
Filesize
140KB

MD5
e503921a6061251302cb45772cb75f42

SHA1
b84a9daf1250dd33962feb6faaa122273a0b29a2

SHA256
970bfe2045464dfda89a1cd262f09813ab9c9ceb3c7375f02bca8aeecdc4cfcb

SHA512
d52b471d3e71e255d5bc7c9f04e141e80e750482183b770fdc35c08c0cc696c66643bc7074ebbeb2f9d95b6b728666414ad0ae5908f16e9a6e21d159dce33c48

Download Submit
memory/1072-199-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-200-0x0000000011000000-0x0000000011179000-memory.dmp

Filesize
1.5MB

Download
memory/1072-163-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/1072-164-0x0000000011000000-0x0000000011179000-memory.dmp

Filesize
1.5MB

Download
memory/1072-165-0x0000000012000000-0x000000001205F000-memory.dmp

Filesize
380KB

Download
memory/1072-149-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download
memory/1072-148-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/1072-147-0x0000000006580000-0x0000000006581000-memory.dmp

Filesize
4KB

Download
memory/1072-151-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-154-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1072-201-0x0000000012000000-0x000000001205F000-memory.dmp

Filesize
380KB

Download
memory/1072-135-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1072-207-0x0000000011000000-0x0000000011179000-memory.dmp

Filesize
1.5MB

Download
memory/1072-213-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-216-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-222-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-230-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-236-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-242-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/1072-248-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads