a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe
Size

10.4MB
MD5

14f2a262a36ab3004b09a928c3726327
SHA1

bf27b78450a68ee1a05497f9baa46b1d59d47204
SHA256

a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6
SHA512

fb0c2962ac6646890d0d64695bb0b1eed237e80152d036f30977f92daff7fcdae03f62ebb549df553d3805eb5d331d2642c08ca62e95d76b6a39b729f577e03b
SSDEEP

196608:IdcckNrJv72gHhfM1D3YoXjhnpvbAKNljRSXlT/MGP2zSRj297uQU+k:Idknj2gBRo/DAKNe/MGP+ej2NI+k

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023226-13.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1252	a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023226-13.dat	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe
1252	a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe

C:\Users\Admin\AppData\Local\Temp\a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe
"C:\Users\Admin\AppData\Local\Temp\a21e213cc66a4d7782a18199173080239d450df69664e434c88bb039e2df97d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegDm.dll

Filesize
52KB

MD5
fdc8b75a37017141831e3421479307be

SHA1
f6a08cc570d5e5bc4218da376ca353d46d62790d

SHA256
2a37ce301490bd4b7c5d02b768b054705fe4620db6ef81061718c1fe89c9f27e

SHA512
d74e2de28523317c928965affa464cef6ba5c4da9ab05d30a79a4d3bbb59284d68331b5735c705cf73e155cf3a42b01ef5cd7219c72c242eed6b711090066537

Download Submit
C:\Users\Admin\AppData\Local\Temp\dm.dll

Filesize
3.5MB

MD5
c71b7acaec5a64425888ca418b9c5c7c

SHA1
f8fe8eef33e5df5d8b7778d715de12bd7efcac4c

SHA256
bb22019d5ad96ab741bb53b454f730b893cf92deefb0be9ea3f34297673c6bb7

SHA512
85f40ebf1c1104c87ebfaad55241656cf1b6ed3f1e97d221e193f09cbacf73c2fd7f4e8378770c742b6fe56153deee379ec6d98f2a3f55cc076cc9e43e9fde2e

Download Submit
memory/1252-19-0x00000000778F3000-0x00000000778F4000-memory.dmp

Filesize
4KB

Download
memory/1252-7-0x00000000778F2000-0x00000000778F3000-memory.dmp

Filesize
4KB

Download
memory/1252-9-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-8-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1252-6-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-18-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-15-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-10-0x00000000778F2000-0x00000000778F3000-memory.dmp

Filesize
4KB

Download
memory/1252-20-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/1252-21-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-22-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/1252-23-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download