Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
27/08/2023, 18:05
General
-
Target
b508bc3b8c31e68f91367c24bb19984237be22dab417af80f541e002959a53dd.exe
-
Size
12.2MB
-
MD5
e1a9feb113902f6ca3b34f8fda0ce9e5
-
SHA1
148586c97ae802f3cbb72cec0ce49bb84eac4e9e
-
SHA256
b508bc3b8c31e68f91367c24bb19984237be22dab417af80f541e002959a53dd
-
SHA512
06b37fdcb1e70b79b59681f4591b2cbe5b06cc4edf8058027255c629ff4f730dff486ca30599caf968d446b6f317d00a2a1ea9489871896c1f06d690dd95d467
-
SSDEEP
196608:PONsv97d2yOyiWNDOCjOMcmef7aZ9hR1M7/bOCz+68Hy+uU1q7RLW8im4/LKCm/7:P+s3qjW5qKefw7R1M7TOCzdMsyLKCmz
Malware Config
Extracted
Protocol: ftp- Host:
49.235.120.125 - Port:
21 - Username:
geqian - Password:
Liu382818
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 41 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b508bc3b8c31e68f91367c24bb19984237be22dab417af80f541e002959a53dd.exe"C:\Users\Admin\AppData\Local\Temp\b508bc3b8c31e68f91367c24bb19984237be22dab417af80f541e002959a53dd.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lGnDm\7za.exe"C:\Users\Admin\AppData\Local\Temp\lGnDm\7za.exe" x -aoa "C:\Users\Admin\Desktop\ͼ±ê.zip" -o"C:\Users\Admin\Desktop\"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5660e9b1c62395179395401aab5bd8232
SHA1dd38d01cd58302161f41cea7731eac242ddc7e54
SHA2569505d0b7337876295cd5926d4284ab4204d7fac5eb55753effadce309aaad8cf
SHA512dbe163db0cfefb64b56ec1e4f50739b04b96a9a0ddf720caa14bd540a9cf60966fdd33c094e53d926adb995075aa0590713e920389e854c30478d90c8f323f70
-
Filesize
716KB
MD5744d0e63bcb20438dd3efcd764503490
SHA14e9d49a41201e25cf56658578b23f7384a13dc6d
SHA25677613cca716edf68b9d5bab951463ed7fade5bc0ec465b36190a76299c50f117
SHA512f501a5375a30254f007c86f1881fa0136fe29f6213b9ed79cfa7f4b7e6b698eb3f7d7c88ffb3e68a66d548e58953158a8354883c3a772b0334ffab4acd9b0067
-
Filesize
2.9MB
MD57f86bd9d84222f05462ef2ecb0b2b2ac
SHA1c57c2700559928b1561b7b0154e5c99c2cba66fd
SHA256022f52c7bba979a680c5b125224daa2a5eeee8d773467a50a28bfd8b57efd337
SHA51246aa6a7f65141b90044b72e3788cbe21158bfae2854f45feb3e541eb1ccdb1227dad447aedc2ea935c0049e7b7d92e12145d4a04a7bba08f2641a2a70819a7b1
-
Filesize
8B
MD57bb0edd98f22430a03b67f853e83c2ca
SHA18882632b7f0dffa4d723ab9cf17bedb55690ba5b
SHA2568b6fa01313ce51afc09e610f819250da501778ad363cba4f9e312a6ec823d42a
SHA512e39e5fa91794c9d7527313433dccf7c4ecc0eac562674eb6ee9b6e30434c92d3350bf6d9ff7a299c143423ed74931975dd16df761d8f0cb75b587c484b5463ab
-
Filesize
52KB
MD5fdc8b75a37017141831e3421479307be
SHA1f6a08cc570d5e5bc4218da376ca353d46d62790d
SHA2562a37ce301490bd4b7c5d02b768b054705fe4620db6ef81061718c1fe89c9f27e
SHA512d74e2de28523317c928965affa464cef6ba5c4da9ab05d30a79a4d3bbb59284d68331b5735c705cf73e155cf3a42b01ef5cd7219c72c242eed6b711090066537
-
Filesize
3.2MB
MD5660e9b1c62395179395401aab5bd8232
SHA1dd38d01cd58302161f41cea7731eac242ddc7e54
SHA2569505d0b7337876295cd5926d4284ab4204d7fac5eb55753effadce309aaad8cf
SHA512dbe163db0cfefb64b56ec1e4f50739b04b96a9a0ddf720caa14bd540a9cf60966fdd33c094e53d926adb995075aa0590713e920389e854c30478d90c8f323f70
-
Filesize
716KB
MD5744d0e63bcb20438dd3efcd764503490
SHA14e9d49a41201e25cf56658578b23f7384a13dc6d
SHA25677613cca716edf68b9d5bab951463ed7fade5bc0ec465b36190a76299c50f117
SHA512f501a5375a30254f007c86f1881fa0136fe29f6213b9ed79cfa7f4b7e6b698eb3f7d7c88ffb3e68a66d548e58953158a8354883c3a772b0334ffab4acd9b0067
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4.8MB
-
Filesize
8.1MB
-
Filesize
9.0MB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
8.1MB
-
Filesize
9.0MB
-
Filesize
84KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
4.8MB
-
Filesize
40KB
-
Filesize
4.8MB
-
Filesize
248KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB