Overview

overview

7

Static

static

3

b8ebb68c1e...c5.exe

windows7-x64

7

b8ebb68c1e...c5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2023, 10:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b8ebb68c1ebc9e98294b7a0fbf362c1030bb701ae9954c3d51f675c172310fc5.exe

  • Size

    3.1MB

  • MD5

    dec11f7b236c4934dec0611c397ad6ec

  • SHA1

    09c9250cd53e6a7610852b9e8fcacd83c8a69ba6

  • SHA256

    b8ebb68c1ebc9e98294b7a0fbf362c1030bb701ae9954c3d51f675c172310fc5

  • SHA512

    687ee33db7326d03c76c0fad3cc8cb0a8a100b25953e37fb7876e2bd898f77b3b60661e2077838182295b55d648d02c02be9eeeb56a704d63cc928969d43094b

  • SSDEEP

    98304:7VSoJMd9caV2SnGJ5eJwa27ncMUjuDk554R2J:E4cYeJh2zcG4FJ

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 4 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8ebb68c1ebc9e98294b7a0fbf362c1030bb701ae9954c3d51f675c172310fc5.exe
    "C:\Users\Admin\AppData\Local\Temp\b8ebb68c1ebc9e98294b7a0fbf362c1030bb701ae9954c3d51f675c172310fc5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 984
      2⤵
      • Program crash
      PID:4360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2684 -ip 2684
    1⤵
      PID:4736

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\ee\Plugins\rdjson.dll
            Filesize

            192KB

            MD5

            2244857ed4d33e3ab8b32c1a09eaff39

            SHA1

            9af9d5bc1be9c202471075b5222500c409428fd0

            SHA256

            e345f88529b2337bb2719550985a049c61a6bca84c113c7b07f7ec5313446f7d

            SHA512

            c88af689b603c22dac0be5cdb0922d0bb58325ee57d736b6fa090e967704edb5fa535100149fd5d02ac764ab32b0ccea99310dd28101ffc907a58414e8867590

            Download Submit

          • C:\Users\Admin\Documents\ee\Plugins\WebView2.dll
            Filesize

            333KB

            MD5

            31c053643e5776f89462db3284ce9f63

            SHA1

            a86d5c11cc109275392b34aa3ee21b86fbe533d9

            SHA256

            60928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c

            SHA512

            f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d

            Download Submit

          • C:\Users\Admin\Documents\ee\Plugins\WebView2.dll
            Filesize

            333KB

            MD5

            31c053643e5776f89462db3284ce9f63

            SHA1

            a86d5c11cc109275392b34aa3ee21b86fbe533d9

            SHA256

            60928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c

            SHA512

            f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d

            Download Submit

          • C:\Users\Admin\Documents\ee\Plugins\WebView2Plus.dll
            Filesize

            1.5MB

            MD5

            574d3209c25d3f2595d0ad97fe7dc949

            SHA1

            cab29752a188d3d6128273d5690d5b64837990d9

            SHA256

            7d00543740e6c254beabab4f0b9f788186b75c97463f552e84b394d2b359479a

            SHA512

            4f48054b7ebacdd61a4469c49156e5e53a6403533badfd2342049c7e2ee8ae816dff6009c7d5840f5de99272f17a1705ec6ed53f1437b7923c408be61523641b

            Download Submit

          • C:\Users\Admin\Documents\ee\Plugins\hp_socket4c.dll
            Filesize

            792KB

            MD5

            6637599f87ab11b6238f2f24c55797fc

            SHA1

            a84090bed39c91503300ab3bd78883001bf71aac

            SHA256

            65e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac

            SHA512

            8edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828

            Download Submit

          • C:\Users\Admin\Documents\ee\Plugins\hp_socket4c.dll
            Filesize

            792KB

            MD5

            6637599f87ab11b6238f2f24c55797fc

            SHA1

            a84090bed39c91503300ab3bd78883001bf71aac

            SHA256

            65e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac

            SHA512

            8edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828

            Download Submit

          • memory/2684-22-0x0000000074200000-0x0000000074314000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2684-11-0x0000000074440000-0x0000000074678000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2684-4-0x0000000010000000-0x000000001032B000-memory.dmp

            Filesize

            3.2MB

            Download

          • memory/2684-25-0x0000000010000000-0x000000001032B000-memory.dmp

            Filesize

            3.2MB

            Download

          • memory/2684-27-0x0000000074440000-0x0000000074678000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2684-28-0x0000000074200000-0x0000000074314000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2684-29-0x0000000010000000-0x000000001032B000-memory.dmp

            Filesize

            3.2MB

            Download

          • memory/2684-31-0x0000000074200000-0x0000000074314000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2684-30-0x0000000074440000-0x0000000074678000-memory.dmp

            Filesize

            2.2MB

            Download