8636da7716a63699824f4e2817ba6a704b847d08bc3687434603435a1935411d

General

Target

f8ca7d9d8ade0cf6e793954cdb392918.exe
Size

962KB
MD5

f8ca7d9d8ade0cf6e793954cdb392918
SHA1

23c0ba5b4b901dd0b5d07e08439efe74868cdf48
SHA256

8636da7716a63699824f4e2817ba6a704b847d08bc3687434603435a1935411d
SHA512

5f6707482b30d27a3fa4e74acafecd206acfa248e2a382fbaf0749123c8ea3ea744bd6d61c7d5a99038353e2a2be4e4c5c10397f1b5dfbb0406e4eefa2758a3f
SSDEEP

12288:o47scOEzl0RgI7h2wG64tWfQE+Qdn9kGkBWW9Gt283x2OnSYi4z2YIRYQOUCJLa:bsmILGrtWoonkGk5E3x2GDzFIRYQPCRa

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00060000000231f0-12.dat	acprotect
behavioral2/memory/1344-30-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect
behavioral2/files/0x00060000000231ef-21.dat	acprotect
behavioral2/files/0x00060000000231f1-19.dat	acprotect
behavioral2/files/0x00060000000231ee-16.dat	acprotect
behavioral2/files/0x00080000000231e7-15.dat	acprotect
behavioral2/memory/1344-34-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1344	mutX_built_ff.exe
1200	RapidShare Plus.exe

Loads dropped DLL 5 IoCs

pid	Process
1344	mutX_built_ff.exe
1344	mutX_built_ff.exe
1344	mutX_built_ff.exe
1344	mutX_built_ff.exe
1344	mutX_built_ff.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231f0-12.dat	upx
behavioral2/memory/1344-23-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral2/memory/1344-31-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral2/memory/1344-29-0x0000000060210000-0x000000006021A000-memory.dmp	upx
behavioral2/memory/1344-30-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral2/files/0x00060000000231ef-21.dat	upx
behavioral2/files/0x00060000000231f1-19.dat	upx
behavioral2/files/0x00060000000231ee-16.dat	upx
behavioral2/files/0x00080000000231e7-15.dat	upx
behavioral2/memory/1344-14-0x0000000060170000-0x00000000601D7000-memory.dmp	upx
behavioral2/memory/1344-32-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral2/memory/1344-35-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral2/memory/1344-34-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral2/memory/1344-33-0x0000000060210000-0x000000006021A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1344	2624	f8ca7d9d8ade0cf6e793954cdb392918.exe	27
PID 2624 wrote to memory of 1344	2624	f8ca7d9d8ade0cf6e793954cdb392918.exe	27
PID 2624 wrote to memory of 1344	2624	f8ca7d9d8ade0cf6e793954cdb392918.exe	27
PID 2624 wrote to memory of 1200	2624	f8ca7d9d8ade0cf6e793954cdb392918.exe	92
PID 2624 wrote to memory of 1200	2624	f8ca7d9d8ade0cf6e793954cdb392918.exe	92

C:\Users\Admin\AppData\Local\Temp\f8ca7d9d8ade0cf6e793954cdb392918.exe
"C:\Users\Admin\AppData\Local\Temp\f8ca7d9d8ade0cf6e793954cdb392918.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\mutX_built_ff.exe
  "C:\Users\Admin\AppData\Local\Temp\mutX_built_ff.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\RapidShare Plus.exe
  "C:\Users\Admin\AppData\Local\Temp\RapidShare Plus.exe"
  2⤵
  - Executes dropped EXE
  PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RapidShare Plus.exe

Filesize
35KB

MD5
64d2881a60eb2481e0698b9e9a60f6da

SHA1
56dd29668e898494869bcd5a24cfa8bf174310b2

SHA256
a4fb91ec5e76a008b883ef4ba18454ed9aa48b64c718669950e73607f7cb740f

SHA512
46b0933b0b1f0eed57688f3fd66947bd487f47975abe0c769e5093b0991381ebb6424689d600c421eeab62425d6f829d7274b2e0fa84b92029f1de1b55ae43d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mutX_built_ff.exe

Filesize
105KB

MD5
347d255473d6866f28dc9b19e3ef93f0

SHA1
8e9bf152aa5b668dc0d2c342d8dde33adcda8ea6

SHA256
807df0e2bd577c3585d3d90fd1a33f4b1446df189e5d8ac8ae5c7759d6b21cde

SHA512
362c0028120676098aba7a6a3a0158da92cc44637d795629a0f072ddc0aaf569907a71c1fba14eecbbf79d6dac0ae1e689aac8d2c6c26774fd1684bc8e10e8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\mutX_built_ff.exe

Filesize
67KB

MD5
c939eaf7a925ab60722aaab729644d5c

SHA1
e77165ddfa9a10c77c20f32340d167b7d4458d35

SHA256
e60e671f9cdfd8a9c1269bb71d3ed21caaa1c800f4ea75403a5907748470ddd2

SHA512
6a299226429f46b3b14537f644a6d890c9700a2686fadc4633619e4dc2ffcd4b3763e41df58c8801b2da8bad6f690dacc9f2c66206c55437a734020cc680a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspr4.dll

Filesize
72KB

MD5
72414dfb0b112c664d2c8d1215674e09

SHA1
50a1e61309741e92fe3931d8eb606f8ada582c0a

SHA256
69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

SHA512
41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3.dll

Filesize
66KB

MD5
dcae47a110c7269d1d4da817f9e3cb24

SHA1
4ad95a2e74fecde53716cbc15a6f1b52e0b8ed17

SHA256
2984a0ee0a365a7ddc161fdba469d32cf8995bd1ab726901537845ff9cb7ffff

SHA512
d4a9d4d21f7c3c8b433196355136e84ab351e613a4ddabfe69a1e07b816732bd45133642f6e81b9f334aa0bcf4faa8f2966f7060565caf8fee8d498883168ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\plc4.dll

Filesize
8KB

MD5
c73ec58b42e66443fafc03f3a84dcef9

SHA1
5e91f467fe853da2c437f887162bccc6fd9d9dbe

SHA256
2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

SHA512
6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\plds4.dll

Filesize
6KB

MD5
ee44d5d780521816c906568a8798ed2f

SHA1
2da1b06d5de378cbfc7f2614a0f280f59f2b1224

SHA256
50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

SHA512
634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\softokn3.dll

Filesize
107KB

MD5
6af234c2e8542d34902e901d4cc3221d

SHA1
275467140094617576ab96711d90dbc1fbd13a33

SHA256
773e63b321d9411fb36c957c4a78a163d5389b18094be6e6b5ef6f8121e1e015

SHA512
5c5f092b14332563f873af052233713004d8849d29a7cf5f2ff8ce6c3123a17d192b1c900fc0aaff901c4f76559553050116d226e723de90a14ecbf8d3013e3f

Download Submit
memory/1200-51-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/1200-50-0x00007FF993C90000-0x00007FF994631000-memory.dmp

Filesize
9.6MB

Download
memory/1200-45-0x000000001BF90000-0x000000001C45E000-memory.dmp

Filesize
4.8MB

Download
memory/1200-49-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/1200-48-0x00000000012F0000-0x00000000012F8000-memory.dmp

Filesize
32KB

Download
memory/1200-47-0x000000001B8E0000-0x000000001B97C000-memory.dmp

Filesize
624KB

Download
memory/1200-46-0x00007FF993C90000-0x00007FF994631000-memory.dmp

Filesize
9.6MB

Download
memory/1200-52-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/1200-44-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/1200-43-0x00007FF993C90000-0x00007FF994631000-memory.dmp

Filesize
9.6MB

Download
memory/1344-30-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/1344-33-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/1344-34-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/1344-35-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/1344-32-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download
memory/1344-14-0x0000000060170000-0x00000000601D7000-memory.dmp

Filesize
412KB

Download
memory/1344-29-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/1344-31-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/1344-23-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing