Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
08/01/2024, 01:00
General
- Target 4a3baec103a3c4d3da41d31e01eb2f06.exe
- Size 328KB
- Sample240108-bcrg1saec5
- SHA256 dd687080617b45e77cbfc1d2a6366bb807cdf03c89300f507b02c55153225582
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a3baec103a3c4d3da41d31e01eb2f06.exe"C:\Users\Admin\AppData\Local\Temp\4a3baec103a3c4d3da41d31e01eb2f06.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aRC_XM.dll
aut7BC8.tmp
memory/804-0-0x0000000000400000-0x000000000048C000-memory.dmp
memory/804-25-0x0000000010000000-0x0000000010011000-memory.dmp
memory/804-26-0x0000000000400000-0x000000000048C000-memory.dmp