4c41f2783d06008860fab234871376902930f6e07b85ab0c0a0f0c47e555534c

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59acfdfef603a6a182e837a1e742f1c4.exe
Size

2.0MB
MD5

59acfdfef603a6a182e837a1e742f1c4
SHA1

a16f8c195afaa84ed252d933141ad45a341f7cf1
SHA256

4c41f2783d06008860fab234871376902930f6e07b85ab0c0a0f0c47e555534c
SHA512

e86b353d7006d88e0b6e99bcaea7dba21b3f23503fe777e7d5fb6a8bf65adcb2f2645b86769ae956a3c51f02be53d93db1054ba8543f95e89762e48016993887
SSDEEP

24576:0HBtt7kdKOt47dwAV9apywMGunNtOcGW17Qcd7jizMSj3b8kAJXoC/1Zi3kIMeZ6:8GK57JLapylGuNUlcj6M1Xn3wJ0QNS1l

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000015e2f-10.dat	acprotect

Loads dropped DLL 4 IoCs

pid	Process
3012	59acfdfef603a6a182e837a1e742f1c4.exe
3012	59acfdfef603a6a182e837a1e742f1c4.exe
3012	59acfdfef603a6a182e837a1e742f1c4.exe
3012	59acfdfef603a6a182e837a1e742f1c4.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015e2f-10.dat	upx
behavioral1/memory/3012-12-0x00000000024A0000-0x00000000024DB000-memory.dmp	upx
behavioral1/memory/3012-14-0x00000000024A0000-0x00000000024DB000-memory.dmp	upx
behavioral1/memory/3012-28-0x00000000024A0000-0x00000000024DB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	59acfdfef603a6a182e837a1e742f1c4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	59acfdfef603a6a182e837a1e742f1c4.exe

C:\Users\Admin\AppData\Local\Temp\59acfdfef603a6a182e837a1e742f1c4.exe
"C:\Users\Admin\AppData\Local\Temp\59acfdfef603a6a182e837a1e742f1c4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd66A0.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nsd66A0.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsd66A0.tmp\SkinH.dll

Filesize
89KB

MD5
205e3693cb24b95018eaee62af86ae03

SHA1
038749709bb472031c000557e57857222619dcd5

SHA256
4954323e4532552e5b3691986d579fdce8ebe60b6ec1eb049658103e05c9d52d

SHA512
4115d76eb964e8c84810ca1cb7758c74ef80d99168f38fb9ce036cea58f69b6579eabc16527b529a7f390f220d71952cbbcda84d20a05ef881714cf2c9a645cf

Download Submit
\Users\Admin\AppData\Local\Temp\nsd66A0.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
memory/3012-12-0x00000000024A0000-0x00000000024DB000-memory.dmp

Filesize
236KB

Download
memory/3012-14-0x00000000024A0000-0x00000000024DB000-memory.dmp

Filesize
236KB

Download
memory/3012-27-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3012-26-0x0000000002550000-0x0000000002553000-memory.dmp

Filesize
12KB

Download
memory/3012-28-0x00000000024A0000-0x00000000024DB000-memory.dmp

Filesize
236KB

Download
memory/3012-30-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download