Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13-10-2023 23:02
General
-
Target
334b0146f08f2f23c5da72d82e7705836cc504e86e79e66e4e4b423c91ad1efa.exe
-
Size
10.3MB
-
MD5
8199091c471810e292ce733d456aec04
-
SHA1
539f6b6d7b818fb02d5613fefdba7dcc63d8d91d
-
SHA256
334b0146f08f2f23c5da72d82e7705836cc504e86e79e66e4e4b423c91ad1efa
-
SHA512
d1041b0d3322eda6ff27d07e3d72c91c36c4408bd10e13e7dcf8474cab9d66c70bd55c7cbfbebe43b9ce267d861060a2a45168dcda85af461e7a538869476f1c
-
SSDEEP
196608:E9TMF9bVn1q2R93lJwP+VeQSPdWHqNFnuv/6/1iPXFi0B9fbCbpp6ZwXW6:8I9bN1BR91Jq+oEE//CzClplv
Malware Config
Signatures
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 40 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 14 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\334b0146f08f2f23c5da72d82e7705836cc504e86e79e66e4e4b423c91ad1efa.exe"C:\Users\Admin\AppData\Local\Temp\334b0146f08f2f23c5da72d82e7705836cc504e86e79e66e4e4b423c91ad1efa.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\downNew.exe"C:\Users\Admin\AppData\Local\Temp\downNew.exe" 22.6 24.6 http://s-bj-7575-update.oss.dogecdn.com/X%E6%88%98%E8%AD%A6%E5%89%8D%E5%8F%B0V24.6.zip ÓÅ»¯ C:\Users\Admin\AppData\Local\Temp\334b0146f08f2f23c5da72d82e7705836cc504e86e79e66e4e4b423c91ad1efa.exe XÕ½¾¯Ç°Ì¨ 24.6 XÕ½¾¯Ç°Ì¨V24.6 ¼Ù2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD540b2d7a36450f08a317428c52dc84ae3
SHA123a325537a84ed0811b04d6f8124284099672283
SHA25695162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
SHA51287b1674ba12ee3a0380ddf15b951d3a6474771f30f75dc1b4d990666d9cf5091521e9c625f4fe63839e097c48f54450b568c551f27acd39774bbf99fe4348a11
-
Filesize
1.3MB
MD540b2d7a36450f08a317428c52dc84ae3
SHA123a325537a84ed0811b04d6f8124284099672283
SHA25695162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
SHA51287b1674ba12ee3a0380ddf15b951d3a6474771f30f75dc1b4d990666d9cf5091521e9c625f4fe63839e097c48f54450b568c551f27acd39774bbf99fe4348a11
-
Filesize
1.3MB
MD540b2d7a36450f08a317428c52dc84ae3
SHA123a325537a84ed0811b04d6f8124284099672283
SHA25695162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
SHA51287b1674ba12ee3a0380ddf15b951d3a6474771f30f75dc1b4d990666d9cf5091521e9c625f4fe63839e097c48f54450b568c551f27acd39774bbf99fe4348a11
-
Filesize
2.8MB
MD50d876831e50bdbe4ce2c4999dbfebaff
SHA1207dfbc239789c98e50ac2d4d7cd94c2ab8569a4
SHA256dc4936ca53cd4a2ef1fc3c4bafc53391afd434c6d9b2eb9ab6c527a32ee7b5f4
SHA512df16aeadd39233f92d250581db48037aa55c836a34478018e38b37a47a618f1a32cf3fde8c1adadafac19d02e276c0d43f53216b2dc11f04fa24b4ebe15addd4
-
Filesize
1.3MB
MD540b2d7a36450f08a317428c52dc84ae3
SHA123a325537a84ed0811b04d6f8124284099672283
SHA25695162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
SHA51287b1674ba12ee3a0380ddf15b951d3a6474771f30f75dc1b4d990666d9cf5091521e9c625f4fe63839e097c48f54450b568c551f27acd39774bbf99fe4348a11
-
Filesize
1.3MB
MD540b2d7a36450f08a317428c52dc84ae3
SHA123a325537a84ed0811b04d6f8124284099672283
SHA25695162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
SHA51287b1674ba12ee3a0380ddf15b951d3a6474771f30f75dc1b4d990666d9cf5091521e9c625f4fe63839e097c48f54450b568c551f27acd39774bbf99fe4348a11
-
Filesize
2.8MB
MD50d876831e50bdbe4ce2c4999dbfebaff
SHA1207dfbc239789c98e50ac2d4d7cd94c2ab8569a4
SHA256dc4936ca53cd4a2ef1fc3c4bafc53391afd434c6d9b2eb9ab6c527a32ee7b5f4
SHA512df16aeadd39233f92d250581db48037aa55c836a34478018e38b37a47a618f1a32cf3fde8c1adadafac19d02e276c0d43f53216b2dc11f04fa24b4ebe15addd4
-
Filesize
1.5MB
MD57323cb5e34ff064158f8c898e0f5537c
SHA1a413c904bc12a9029d073194678a8a3dc0fd78e6
SHA25633c1dcf45e4298c604037ba25fca7aef8bbe65dc019f20966ee37908b065aa21
SHA512f29b36fefb5cf1f0b19a7e68fa0460c265ace1dbfbac62589025d448ade1d72038dcf8b2abc50d95c48d9ea229dd3d53bb2d4ee3f178ad26c7ab56f7a93b7725
-
Filesize
244KB
-
Filesize
3.2MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
26.3MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
524KB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
26.3MB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.3MB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
26.3MB
-
Filesize
2.7MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB