1b503d69fc1ca46a29367cd95a395503d2ef08c17912b38698a3e8e4ea846407

General

Target

smb_t.exe
Size

3.1MB
MD5

c6666bd1f35c190e8d82bfcf033b56db
SHA1

db0eae54d96ea2ad7ae5afe9b11dff3598fde69e
SHA256

1b503d69fc1ca46a29367cd95a395503d2ef08c17912b38698a3e8e4ea846407
SHA512

63ef48a55c92bd768d0b977f09a730e6aec5dc455b3a18b454854ad790394365f364516f904aa5c606559f8ae0589f8c23f8e89e0e249d844e382555edc63719
SSDEEP

98304:ACkoDEPW7D03T8qwW8Hp1pEqjKz8JDO1T5aOh+45z:A3JH3T8qwWskkKz8JDO1Zh5

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e2a-14.dat	acprotect
behavioral2/files/0x0006000000022e2a-15.dat	acprotect
behavioral2/files/0x0006000000022e23-17.dat	acprotect
behavioral2/files/0x0006000000022e23-18.dat	acprotect
behavioral2/files/0x0006000000022e25-20.dat	acprotect
behavioral2/files/0x0006000000022e25-21.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
2244	smb_t.exe
2244	smb_t.exe
2244	smb_t.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4404-0-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral2/files/0x0006000000022e2a-14.dat	upx
behavioral2/files/0x0006000000022e2a-15.dat	upx
behavioral2/memory/2244-16-0x0000000074A20000-0x0000000074CD0000-memory.dmp	upx
behavioral2/files/0x0006000000022e23-17.dat	upx
behavioral2/files/0x0006000000022e23-18.dat	upx
behavioral2/files/0x0006000000022e25-20.dat	upx
behavioral2/files/0x0006000000022e25-21.dat	upx
behavioral2/memory/2244-19-0x0000000074950000-0x0000000074961000-memory.dmp	upx
behavioral2/memory/2244-22-0x00000000747E0000-0x0000000074949000-memory.dmp	upx
behavioral2/memory/2244-23-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral2/memory/2244-24-0x0000000074A20000-0x0000000074CD0000-memory.dmp	upx
behavioral2/memory/2244-25-0x0000000074950000-0x0000000074961000-memory.dmp	upx
behavioral2/memory/2244-26-0x00000000747E0000-0x0000000074949000-memory.dmp	upx
behavioral2/memory/4404-35-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2244	4404	smb_t.exe	88
PID 4404 wrote to memory of 2244	4404	smb_t.exe	88
PID 4404 wrote to memory of 2244	4404	smb_t.exe	88

C:\Users\Admin\AppData\Local\Temp\smb_t.exe
"C:\Users\Admin\AppData\Local\Temp\smb_t.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\smb_t.exe
  "C:\Users\Admin\AppData\Local\Temp\smb_t.exe"
  2⤵
  - Loads dropped DLL
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI44042\_socket.pyd

Filesize
21KB

MD5
41d653f1f10ebafd8463ccdc67a3e4a7

SHA1
3cd63a6fcd0585d6e5443338d953c42c65748b9e

SHA256
afcfdbbaf2f191b00fbf3a4c258b5f4847234081f2878c99ed87557d46c1083c

SHA512
dfd7b54428a239c6b72faa3e701c9bd4f6388f1047334f46695db80107d84fe6eef21cae010e34be68afff88b805dddca8016c4e5cab674124e8dd64003a6e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44042\_ssl.pyd

Filesize
487KB

MD5
f210da7c3094ae904b3ee232a3dbc767

SHA1
91131ed18722f3616b546a013fc62a5f2bbeb4c3

SHA256
c8506fa1605cb9f8ed5da2d6d07e9fae623e3dcd43254a4c13778b9ea91e9d60

SHA512
affca493b46fbe6c48decabc889a8234842b5bbb699cd4306009cf11972ea2ba0d5200cc0d33a9d1d86741d892111fc5fe71636495b7c9040957578ef7877365

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44042\python27.dll

Filesize
877KB

MD5
72e2b0efac088a4d73e8481472c33a74

SHA1
a3755402086dce748761f5b2ea3df82afc4626f4

SHA256
9b6fe45f8f42a8a326d1668d8e4f4aaa2007b60a263f0c88248fc405efc17cd4

SHA512
0b0be5c644e7f323555dc30ada4998a322a406b3443b1b5fdbc0858edeb0ace348b0b5bf4e173eb60fda2888496fa9c6b719ff4ea9c7c8cc0c8c5e9bb1103523

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44042\python27.dll

Filesize
877KB

MD5
72e2b0efac088a4d73e8481472c33a74

SHA1
a3755402086dce748761f5b2ea3df82afc4626f4

SHA256
9b6fe45f8f42a8a326d1668d8e4f4aaa2007b60a263f0c88248fc405efc17cd4

SHA512
0b0be5c644e7f323555dc30ada4998a322a406b3443b1b5fdbc0858edeb0ace348b0b5bf4e173eb60fda2888496fa9c6b719ff4ea9c7c8cc0c8c5e9bb1103523

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44042\smb_scan.exe.manifest

Filesize
1012B

MD5
29f681684645273e5b084c5c66f7e0a2

SHA1
af1ff5e66c496746d75e7a7b492df60e673e928e

SHA256
c6bbb7e6b84326665db8d220c989444a1e1872b658f23c37c470268f36b7f696

SHA512
0c12870aca2f05a4219415c0b7e97522953e146f526a28716e87ea0230e348e242b3c1ad3ffa0ebefa54076ce4e26b0a81b55e21dfeb42293d08ebe01cb98475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44~1\_socket.pyd

Filesize
21KB

MD5
41d653f1f10ebafd8463ccdc67a3e4a7

SHA1
3cd63a6fcd0585d6e5443338d953c42c65748b9e

SHA256
afcfdbbaf2f191b00fbf3a4c258b5f4847234081f2878c99ed87557d46c1083c

SHA512
dfd7b54428a239c6b72faa3e701c9bd4f6388f1047334f46695db80107d84fe6eef21cae010e34be68afff88b805dddca8016c4e5cab674124e8dd64003a6e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44~1\_ssl.pyd

Filesize
487KB

MD5
f210da7c3094ae904b3ee232a3dbc767

SHA1
91131ed18722f3616b546a013fc62a5f2bbeb4c3

SHA256
c8506fa1605cb9f8ed5da2d6d07e9fae623e3dcd43254a4c13778b9ea91e9d60

SHA512
affca493b46fbe6c48decabc889a8234842b5bbb699cd4306009cf11972ea2ba0d5200cc0d33a9d1d86741d892111fc5fe71636495b7c9040957578ef7877365

Download Submit
memory/2244-16-0x0000000074A20000-0x0000000074CD0000-memory.dmp

Filesize
2.7MB

Download
memory/2244-19-0x0000000074950000-0x0000000074961000-memory.dmp

Filesize
68KB

Download
memory/2244-22-0x00000000747E0000-0x0000000074949000-memory.dmp

Filesize
1.4MB

Download
memory/2244-23-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-24-0x0000000074A20000-0x0000000074CD0000-memory.dmp

Filesize
2.7MB

Download
memory/2244-25-0x0000000074950000-0x0000000074961000-memory.dmp

Filesize
68KB

Download
memory/2244-26-0x00000000747E0000-0x0000000074949000-memory.dmp

Filesize
1.4MB

Download
memory/4404-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing