Analysis
-
max time kernel
167s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
16-11-2023 08:48
General
-
Target
ab62e9c1b19942041026b6600739b7e4b213e7badae97f4e64d12a14451967ad.exe
-
Size
6.4MB
-
MD5
75e0aa1b04ed73e11d4a1cc99f690533
-
SHA1
3bfd8c41f0679a5d1f540ccea0190e2c0c09d312
-
SHA256
ab62e9c1b19942041026b6600739b7e4b213e7badae97f4e64d12a14451967ad
-
SHA512
f01ed6df9cbe58e2d1638085b8b781f001efdc9cf4b7b2b814db1b2ba993bff296704f3504b70a06dfabc87a4bb2e499c18eae8acffae14cc38e64f9abbaa4e9
-
SSDEEP
196608:7mY6YFC0xYdVVizSEg11Fm6QvlZvKNipmN0A:j6Y9xQ/11FmN/sWA
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab62e9c1b19942041026b6600739b7e4b213e7badae97f4e64d12a14451967ad.exe"C:\Users\Admin\AppData\Local\Temp\ab62e9c1b19942041026b6600739b7e4b213e7badae97f4e64d12a14451967ad.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 c:\jiaobentupian\dm.dll -s2⤵
- Loads dropped DLL
- Modifies registry class
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD54cf777a1dc8b9374303091d2b09aca4d
SHA172cff7374cd1ec41af6077cfcdb3715a460973a5
SHA256d55a9c60f579e45f55e26cd569e1f1232886293dc06733837e7752b8af77ce68
SHA512148531ba0902a8ad442537e99c7a3c094657b8b2830df41e0b74a89ca11ad61ca4ce678a7c87acaa0acdeffd6739b572619d21ce3bc2aff636443aec011ad977
-
Filesize
12B
MD5efabff6cce5501e6082e5d80d51cf1f6
SHA1676231f0923e25046885d2f9fc618b905676c600
SHA25608646103289c35fb550608a15ca402e73cb44cdf3897e711d0950c3f9ca641af
SHA51201354ce61e8cd2ee56feaa658665d0c1a73f2c413e4f215f28f276b292f0d27a338f0d0d10cd02fde58b01ec269f8cc05a0d809c0badfffdb28558a52aef4672
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
Filesize
4KB
MD55dbe237a1723407af3dadde1b7a8f18a
SHA1aa0b910d87da7570e24598d0369cc96bb9c1f355
SHA2567711180243dcf2aafe67cf476700bcc2708c42b2d872ef2b3c162c9170eff334
SHA512d321ad1e0dbb22695a14a6d3dc4b233f2783ec00514a132641467d2dd0a2755c85023b0646010953ce3ce6ad7afc8279db3dddb2c1e603648d5f3c633572b74b
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
Filesize
1.5MB
-
Filesize
488KB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
1.5MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
2.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
1.5MB