Analysis
-
max time kernel
141s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 15:45
General
-
Target
50489ff45d51588324b7dabc743c29e4e182e9268fc00636546a021a46c0dd4d.exe
-
Size
888KB
-
MD5
15b0f1357575a87b4ea07b5eb7ebf60d
-
SHA1
f7e002be922d2e490499cf0555a4a4afca842e63
-
SHA256
50489ff45d51588324b7dabc743c29e4e182e9268fc00636546a021a46c0dd4d
-
SHA512
669e0292b21748084b448b0545c8a71e487dceb311e276c3225a2ec8bf69bacab1779ec3252a1f40b4ddc20aced23dcaf215ea929a8bc9539eb8203c916b2a68
-
SSDEEP
24576:wQ2NChC/8wVwHZFTwFOOos3Ooc8DHkC2e77TJXb+DKq+0qO/BWqqt7MhewC:wQ2NH8emZFsGQTJL+e0/JvhFC
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 5 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50489ff45d51588324b7dabc743c29e4e182e9268fc00636546a021a46c0dd4d.exe"C:\Users\Admin\AppData\Local\Temp\50489ff45d51588324b7dabc743c29e4e182e9268fc00636546a021a46c0dd4d.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Melody\melody_updater.exe"C:\Program Files (x86)\Melody\melody_updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD507c0df8fdbd1871dbee3eb7db5b54ceb
SHA19f848f1e98fd74091c1f4273939480cd150e5cd3
SHA256a8dfe97b804a6a20d8f4025c144f878b131339b68514d5187b1165dd3546a1b2
SHA512fd4fb98eebade1a5823674713e2a0d49d37f806c7cf1417d0036ad667feae1e9cad982899b68688ed8f4c823cd2664d0ecb4db495c96fabc5294e95483645664
-
Filesize
444KB
MD5fd5cabbe52272bd76007b68186ebaf00
SHA1efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA25687c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
SHA5121563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
Filesize
72KB
MD54f83f2374bb6a1d34cce051b176b7515
SHA146496d62d1ea46a1580fae7a60d9a8da8609c7b6
SHA256c81e85e248e06f6c4df7433901fad8872c5c1775ae73412575980e8ef98b93db
SHA5121a915c8177ecd09693a9ccc76d7490af7cc613e554e2954c08c8981ced40a2fb23cd9be0e0756feb7719a74c98536da804a251c0cda3e6bf84c03221315b811f
-
Filesize
177KB
MD560dfe1f1128044621d8dbda3aefbf61d
SHA1cd8038e6a85b1df05503f9db1f8108b72c3c8467
SHA2566d2c6375b4607ad3106ae19de8b7e4e32684c9aaac23dc8cdf2e2576927ffa6a
SHA512b66a585f88aab6e015629ac920467a4bb5d0eddc60dc09fd9264f7d3cd75310434e5679e4733a97e6fa624f0341a8a85d18df13cbfafdd9f181bb4df26fc8e37
-
Filesize
123KB
MD507c0df8fdbd1871dbee3eb7db5b54ceb
SHA19f848f1e98fd74091c1f4273939480cd150e5cd3
SHA256a8dfe97b804a6a20d8f4025c144f878b131339b68514d5187b1165dd3546a1b2
SHA512fd4fb98eebade1a5823674713e2a0d49d37f806c7cf1417d0036ad667feae1e9cad982899b68688ed8f4c823cd2664d0ecb4db495c96fabc5294e95483645664
-
Filesize
72KB
MD54f83f2374bb6a1d34cce051b176b7515
SHA146496d62d1ea46a1580fae7a60d9a8da8609c7b6
SHA256c81e85e248e06f6c4df7433901fad8872c5c1775ae73412575980e8ef98b93db
SHA5121a915c8177ecd09693a9ccc76d7490af7cc613e554e2954c08c8981ced40a2fb23cd9be0e0756feb7719a74c98536da804a251c0cda3e6bf84c03221315b811f
-
Filesize
177KB
MD560dfe1f1128044621d8dbda3aefbf61d
SHA1cd8038e6a85b1df05503f9db1f8108b72c3c8467
SHA2566d2c6375b4607ad3106ae19de8b7e4e32684c9aaac23dc8cdf2e2576927ffa6a
SHA512b66a585f88aab6e015629ac920467a4bb5d0eddc60dc09fd9264f7d3cd75310434e5679e4733a97e6fa624f0341a8a85d18df13cbfafdd9f181bb4df26fc8e37
-
Filesize
444KB
MD5fd5cabbe52272bd76007b68186ebaf00
SHA1efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA25687c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
SHA5121563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB