e8ea79e4a0ecd9ffcb0f63a867b4110c0b1313c37403166eb973e61af50590d2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

326b5d0b26a05bc72b0554b1ea77b898.exe
Size

53KB
MD5

326b5d0b26a05bc72b0554b1ea77b898
SHA1

450b63daeaaaac057e4a196f48812d844af24c98
SHA256

e8ea79e4a0ecd9ffcb0f63a867b4110c0b1313c37403166eb973e61af50590d2
SHA512

79839b44241edd8d05104548b78fa0398a05023302401716f849c3c5ee3b16a8e0b900db0d55dfa841ad7d49d8a9da5f294b90051370a75a3f51a2ff0afac033
SSDEEP

768:bNYOZWUl2hNU33BDYd+Cnos6oMdKeOJPD8OnVO22UfZrpdJpF:blLsE3ookMdKzbh2YZld

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x001d000000015cac-9.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1632	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
2148	326b5d0b26a05bc72b0554b1ea77b898.exe
1632	cmd.exe
1632	cmd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-1-0x0000000000400000-0x000000000040D600-memory.dmp	upx
behavioral1/files/0x001d000000015cac-9.dat	upx
behavioral1/memory/1632-14-0x0000000010000000-0x0000000010008000-memory.dmp	upx
behavioral1/memory/1632-15-0x0000000010000000-0x0000000010008000-memory.dmp	upx
behavioral1/memory/2148-17-0x0000000000400000-0x000000000040D600-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msnsock.dll	326b5d0b26a05bc72b0554b1ea77b898.exe
File created	C:\Windows\SysWOW64\msnsock.dll	326b5d0b26a05bc72b0554b1ea77b898.exe
File opened for modification	C:\Windows\SysWOW64\msams32.dll	326b5d0b26a05bc72b0554b1ea77b898.exe
File created	C:\Windows\SysWOW64\msams32.dll	326b5d0b26a05bc72b0554b1ea77b898.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	326b5d0b26a05bc72b0554b1ea77b898.exe
Token: SeDebugPrivilege	1632	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1632	2148	326b5d0b26a05bc72b0554b1ea77b898.exe	28
PID 2148 wrote to memory of 1632	2148	326b5d0b26a05bc72b0554b1ea77b898.exe	28
PID 2148 wrote to memory of 1632	2148	326b5d0b26a05bc72b0554b1ea77b898.exe	28
PID 2148 wrote to memory of 1632	2148	326b5d0b26a05bc72b0554b1ea77b898.exe	28
PID 2148 wrote to memory of 1632	2148	326b5d0b26a05bc72b0554b1ea77b898.exe	28
PID 1632 wrote to memory of 2652	1632	cmd.exe	30
PID 1632 wrote to memory of 2652	1632	cmd.exe	30
PID 1632 wrote to memory of 2652	1632	cmd.exe	30
PID 1632 wrote to memory of 2652	1632	cmd.exe	30
PID 1632 wrote to memory of 2652	1632	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\326b5d0b26a05bc72b0554b1ea77b898.exe
"C:\Users\Admin\AppData\Local\Temp\326b5d0b26a05bc72b0554b1ea77b898.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\cmd.exe
  /cC:\Users\Admin\AppData\Local\Temp\\taskmgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
    C:\Users\Admin\AppData\Local\Temp\\taskmgr.exe
    3⤵
    PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msnsock.dll

Filesize
7KB

MD5
77623f1722b820ace688717c6e0c1afc

SHA1
edd29fd09fa4d544e4559a56076b3be0ab462381

SHA256
d6c739ad365a64735e0e20e27d5e601ba4aef72735e132eeaafdd52ab277711e

SHA512
91820b2ac46b0656001e953559ea449c202d6bcb32383419617424d51ebc61a1775b5afd132ed9bfdf85e018893a9f93b84bc0c36422f5057239de30b29aade2

Download Submit
\Users\Admin\AppData\Local\Temp\cmd.exe

Filesize
295KB

MD5
ad7b9c14083b52bc532fba5948342b98

SHA1
ee8cbf12d87c4d388f09b4f69bed2e91682920b5

SHA256
17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae

SHA512
e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

Download Submit
\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
222KB

MD5
545bf7eaa24a9e062857d0742ec0b28a

SHA1
d748d5b325e5dd4fadeb837a59f61e55d2636d31

SHA256
50f2abb613df4813ce74f3b0df080497f689dfcad11f0fc7cd5ea4cdaf093bdf

SHA512
b132a23f443a75deb7bd10415efb871524b63860b2eb30a198dea2f7e67a1fa3bcdc5344dc98f306c8b93452329d6422d5264c1d64a403abeaf7db1662980f1a

Download Submit
memory/1632-7-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1632-14-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1632-15-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2148-1-0x0000000000400000-0x000000000040D600-memory.dmp

Filesize
53KB

Download
memory/2148-17-0x0000000000400000-0x000000000040D600-memory.dmp

Filesize
53KB

Download