Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
26/08/2023, 21:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe
Resource
win7-20230824-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe
Resource
win10v2004-20230824-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe
-
Size
6.2MB
-
MD5
80b525ca0f2e8d9148665d71b1518fa6
-
SHA1
3335d9b429d34dcac50a4646837b82641c3e4093
-
SHA256
eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5
-
SHA512
1de725d19c06902fb139c241c3396bffe88cebaf27668a22e96f21ffbf7378c9040cc4848f804239e07bbc1a12265240a5b25cf842dde8771b722c9cd7041d7e
-
SSDEEP
98304:cgSo95SbWf+YFCNVkIngOOwvUsHbyDdJspObFusEo:cbSQaf+HNuIGsUGbynsgbF3
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000012023-5.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe -
resource yara_rule behavioral1/files/0x000a000000012023-5.dat upx behavioral1/memory/2172-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2172-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2172-11-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 2172 wrote to memory of 3000 2172 eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe 28 PID 3000 wrote to memory of 2508 3000 rundll32.exe 29 PID 3000 wrote to memory of 2508 3000 rundll32.exe 29 PID 3000 wrote to memory of 2508 3000 rundll32.exe 29 PID 3000 wrote to memory of 2508 3000 rundll32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe"C:\Users\Admin\AppData\Local\Temp\eb37a128b5b642f765dcf3b44fa02c76b9972518c737c657b8c7a1adb2498fb5.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,32⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe"C:\Windows\System32\SystemPropertiesAdvanced.exe"3⤵PID:2508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522