Analysis
-
max time kernel
174s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
13dd6357cdfbce65b74225fa6fa8f549.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
13dd6357cdfbce65b74225fa6fa8f549.exe
Resource
win10v2004-20231215-en
General
-
Target
13dd6357cdfbce65b74225fa6fa8f549.exe
-
Size
1.6MB
-
MD5
13dd6357cdfbce65b74225fa6fa8f549
-
SHA1
52b3d8be99aa29feef563f90a0e73a3f6504b282
-
SHA256
fabed020a1738bfd688115afa14988c452a3e778f688eca2e9c53d4b7914a77e
-
SHA512
7d7cd7a09ac30dd8cb7c3b443344201d32ddc3c6b88285028d735986b7d5d2e9d080884fff4a08bcfec6543d6bd5da02449f722295c85f5fcc8058eb4fbff66c
-
SSDEEP
24576:xtmRgSWthQHWKaOvDH7moUtu27AyrMVEe3Nb4ZLkopK6siA6v7i/8NOEdo77Nrn:xNnhSWiHxOu2YVnd4Z3p3sh6v7uNL
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0006000000016d7b-33.dat acprotect behavioral1/files/0x0007000000016fde-47.dat acprotect behavioral1/memory/2364-49-0x0000000074520000-0x0000000074529000-memory.dmp acprotect behavioral1/memory/2364-111-0x0000000074510000-0x0000000074519000-memory.dmp acprotect -
Loads dropped DLL 22 IoCs
pid Process 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe 2364 13dd6357cdfbce65b74225fa6fa8f549.exe -
resource yara_rule behavioral1/files/0x0006000000016d7b-33.dat upx behavioral1/files/0x0007000000016fde-47.dat upx behavioral1/memory/2364-49-0x0000000074520000-0x0000000074529000-memory.dmp upx behavioral1/memory/2364-111-0x0000000074510000-0x0000000074519000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD579320f8b7ae03e3bfda302219e0b4e63
SHA1aed74bd82171c549400cc1c06f2c63b420ca63ea
SHA256a0f21a0430af00f2b16be6a004b2c787198476d569c76be4cd018975366afa6a
SHA512e7b84d0677ab039b48f254526750f39091e0df1771539accc7b97a1b3fe26dac2c7378303f03c9ef9224b49115285400c025b002205b7decba5cf57a9d355ce6
-
Filesize
23KB
MD5125aebb055446fb52aa5956cf99e8a9a
SHA16b58fd08a8ff2763219cc6b0dcdb875f9970f850
SHA2562e1b11ee20e5061ea86dc6b01e3efc659e887540afcab7317cdfd6a8eff87ec3
SHA5125f85e48bd3ae2fd2be0595b93cbf74674e0281210688dcc73691178b295a702e8d43898afb6e5d8b7e82de98b4ee28194c9838ddf8279cde85f7fe48d34dc8b7
-
Filesize
6KB
MD57f780de67db61a924bebc0cafaded3ad
SHA13ac359dce08ceff16e4214fe45d83fdc8e3f2e1a
SHA2569931a2f8bb44b92ff26062b99cbb6e41ed1cfad65079dec5d6d9c006223bd121
SHA5128378f04b6f5085e887ed46874414e5681f0ecb6889dbaa25eb78f75112d4be603aef8dec6a2a81857a19978f6ccf07d65d566ff3f0943da809de22599ffdd8f2
-
Filesize
28KB
MD567728532d0325c6f3bc85827a9594286
SHA1f9809396ab27f263b30a9a5585174ffb71c256cb
SHA25602c008237e8c61ea7ea4e46c9bb47475ae218cf74d2f497fef746909ace19da6
SHA512318f18c574bd79610f77138b0e79bd958f1cd248e6bccf9d24da9169be6298688aa11dc63a6ab1a9ae5bc3b3ef880a97a36a289447f45fb5f9b940eac652f661
-
Filesize
14KB
MD54ef97f2cfcb80fd9a8781fd80e38abaf
SHA1932322e90414818bd8b23d62cfc72ca17e324b5a
SHA2566c24f2149bb5076d933bbaf551081d674f3bc6ea2c3d6368f72886a155c8d41e
SHA51216e7bcbfe1c6250f0b1a11d6b7adb94423e245d2a4c32b5e98eb3ed27e40df5a83aa2c9c5b4c1deb1ec990891e8963dc1cbfac7fb6067c5de3c740d11c3ad036
-
Filesize
11KB
MD5790d227d847f7571c8d58a79057a469e
SHA175c347b1441383c61166b615dfd6e7e65b04629f
SHA25637e99ab9db0045870e31db147438cf0c69b6fcdec4f3737a9743c447cbc0c3c0
SHA5125821605bfb3e57ddfcc1a74829968814aae92b13cb713ef3628913d9112d493117e8aa9cc437770facdcd2d4bd1e53a271d491e6b4d3e4cff53bd027f4b07f4c
-
Filesize
12KB
MD5eb64d073a87db00a3c2f2d2e8641b193
SHA16ffb587461276f954228827a53412880cd7a92eb
SHA2561bb9c2fb5935766f08903fccdda12ed3e32478ad0cc3f8b2ef271c0a7f4bce56
SHA512a5f7590b11f4b9ad903155ed5d237d6762f01183ee023dc319d1dad00b23b04f003b7d751e27f72b678356843a693bdb1ede16a3a0ef34a381611d3d153c4fc7