f8734b4de9204b889305f097427258afa7ea6a9fbeb69d66b67666a3dbb8459e

Analysis

max time kernel
197s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09198f19305e678a73292a5a1951a611.exe
Size

1002KB
MD5

09198f19305e678a73292a5a1951a611
SHA1

dda81bd800c2bb5766d933b67c0581ceea85ae74
SHA256

f8734b4de9204b889305f097427258afa7ea6a9fbeb69d66b67666a3dbb8459e
SHA512

2857d27cb648d9c2f6602252b7015effe950b7d783a9c99b0e61be25ba412e269751acf3a585a6bc5df7cdb580a76a8f4e0d78209b16e7ecda7333ec1c92956e
SSDEEP

24576:VuWQQyPG2vQW0BTEgSuvq5LFg+fsHlLQvUAvxEQXZCTEgg/:VuWXyfSTvS5LFg+Uy1vxwTvg/

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000023225-2.dat	acprotect
behavioral2/memory/3672-5-0x0000000074CE0000-0x0000000074CE9000-memory.dmp	acprotect

Deletes itself 1 IoCs

pid	Process
2936	explorer.exe

Loads dropped DLL 6 IoCs

pid	Process
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023225-2.dat	upx
behavioral2/memory/3672-5-0x0000000074CE0000-0x0000000074CE9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 2936	3672	09198f19305e678a73292a5a1951a611.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\tst_key = "test_ok"	09198f19305e678a73292a5a1951a611.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID	09198f19305e678a73292a5a1951a611.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe
3672	09198f19305e678a73292a5a1951a611.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2936	3672	09198f19305e678a73292a5a1951a611.exe	91
PID 3672 wrote to memory of 2936	3672	09198f19305e678a73292a5a1951a611.exe	91
PID 3672 wrote to memory of 2936	3672	09198f19305e678a73292a5a1951a611.exe	91
PID 3672 wrote to memory of 2936	3672	09198f19305e678a73292a5a1951a611.exe	91

C:\Users\Admin\AppData\Local\Temp\09198f19305e678a73292a5a1951a611.exe
"C:\Users\Admin\AppData\Local\Temp\09198f19305e678a73292a5a1951a611.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nssA295.tmp\SelfDel.dll

Filesize
4KB

MD5
7cff7fe2caea5184d98c147e7e263132

SHA1
21f39d3d0dd5f7198d67ef30e95d10ae3460093e

SHA256
281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101

SHA512
fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssA295.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssA295.tmp\mifuyjnad.dll

Filesize
557KB

MD5
cfd0c9d448f54ac769709e0031a47ae6

SHA1
00316e410406a6fe927e3f014526e84afa8024d8

SHA256
433ae28e10dff308a945af1932bd5555f51e123e5c13934015a587d25466d024

SHA512
4d342cf1e7639869cf2d6d66d55e6d87fec8b4bf595431c40cca5717dc246748b94fd586f1463e6baeb333f6d5ffd24a33fbc72277cdbb5785810c02c53b4f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssA295.tmp\nsProcEx.dll

Filesize
32KB

MD5
5f568bba9381c47f596492563514e350

SHA1
76e599040594144399a07febceb203a102436c79

SHA256
5cd30b2a26dc104173ef5fcda0cef66bafbb0849c466463f0e2db0fc42f5dc24

SHA512
ef7671d2ee56b7f81dd2fc0ecd322796003a8fca6b40efa8d84a25cfe4aa0ea149e83191f664de540fad63876957b9eea00e109e17bf81d125423eeb36769b5d

Download Submit
memory/3672-5-0x0000000074CE0000-0x0000000074CE9000-memory.dmp

Filesize
36KB

Download
memory/3672-25-0x00000000028E0000-0x0000000002972000-memory.dmp

Filesize
584KB

Download