Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
15/07/2023, 01:59
General
-
Target
Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.exe
-
Size
63.2MB
-
MD5
eb3f681012b9858e3967f454cca9d83d
-
SHA1
3a02df20d1c602b178706a2162fcbb1de496837f
-
SHA256
02588ec693e7d5ae938888eef6de3e667b43df94df31f26fb4a888730690f655
-
SHA512
8a9d841d3fc74e273b9fe3a97aa686975d71510a7cbd9ace5d4d1b59da7e4f74b21a051b70806a2aa9e31bb9212607298cab3ce23ffe4a60318c82de09757fea
-
SSDEEP
1572864:BnepHLAOuTIcjrHVOY3sERYws0S/XGx6zczZJtjSbB3aWk3iWHwNLsWw:BeVLAOUjrH3stWx6mD9aaBiWQNLsl
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.exe"C:\Users\Admin\AppData\Local\Temp\Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-F7NLQ.tmp\Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.tmp"C:\Users\Admin\AppData\Local\Temp\is-F7NLQ.tmp\Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.tmp" /SL5="$A004A,65070171,263168,C:\Users\Admin\AppData\Local\Temp\Malwarebytes.Premium.v4.5.33.RePack.by.xetrin_JC.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 &RD /S /Q C:\Users\Admin\AppData\Local\Temp\is-B334I.tmp3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 3 127.0.0.14⤵
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD5aa92ca701521381dda5ec7440095ea66
SHA1cdd9cf34e163e01e84f3bc36954de846760c6a04
SHA2567ee0424eb33bf9127a5b34205e094e63e62997fe6b4f2c363226f9d8d1b13d4e
SHA5122078d1e6b3bd2b96c460f205158927563fd9d040b8a308b7b5d974e7e903e37bb35ac4743efdc4db22adadb65129282040b68cd69378f6e700dfa3feacd668a0
-
Filesize
225KB
MD5aa92ca701521381dda5ec7440095ea66
SHA1cdd9cf34e163e01e84f3bc36954de846760c6a04
SHA2567ee0424eb33bf9127a5b34205e094e63e62997fe6b4f2c363226f9d8d1b13d4e
SHA5122078d1e6b3bd2b96c460f205158927563fd9d040b8a308b7b5d974e7e903e37bb35ac4743efdc4db22adadb65129282040b68cd69378f6e700dfa3feacd668a0
-
Filesize
225KB
MD5aa92ca701521381dda5ec7440095ea66
SHA1cdd9cf34e163e01e84f3bc36954de846760c6a04
SHA2567ee0424eb33bf9127a5b34205e094e63e62997fe6b4f2c363226f9d8d1b13d4e
SHA5122078d1e6b3bd2b96c460f205158927563fd9d040b8a308b7b5d974e7e903e37bb35ac4743efdc4db22adadb65129282040b68cd69378f6e700dfa3feacd668a0
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
3.9MB
MD5de4391e70fbea1c1454e39f088a7aa31
SHA1df541d361956155e21b6acad0af8147d2e6908b5
SHA25693957a488f1db87c154f1f0fec0e7a9e0b260cec98352470d80540913972529c
SHA51261c27a4bcb5aef4b47c8eeed7a8340e834781ea992b214686a475be294dba4daa65be2bcdd2cb6d7cb664b5688a240cd4407ab92e582f23ad9ab4de85007db2c
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB