Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 01:58
General
-
Target
5a663b15f5f3967b10bddcd7588a00b3.exe
-
Size
11.3MB
-
MD5
5a663b15f5f3967b10bddcd7588a00b3
-
SHA1
7e8382654d243a0295721544d47563bd24407ba3
-
SHA256
33ae674ccfa5116ce99906fd28d09ccc29d4fa1855f6f74fbcdee43b7ac57364
-
SHA512
4ce2f628d1484228552694867c872833a5ce3982b055f225ab4636ee960318193d283aa2118584b37925faf4d775cfe2496146284be15a2976df02fd3fe8431e
-
SSDEEP
196608:cZNFljw+RP8NrbVK+c8LCqNGBKhwg2qTcNxxslIbRe5S5:cZNg+R8Nrb48COGBo2p6GeI
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a663b15f5f3967b10bddcd7588a00b3.exe"C:\Users\Admin\AppData\Local\Temp\5a663b15f5f3967b10bddcd7588a00b3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J5FDC.tmp\5a663b15f5f3967b10bddcd7588a00b3.tmp"C:\Users\Admin\AppData\Local\Temp\is-J5FDC.tmp\5a663b15f5f3967b10bddcd7588a00b3.tmp" /SL5="$6011E,10598489,891904,C:\Users\Admin\AppData\Local\Temp\5a663b15f5f3967b10bddcd7588a00b3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x7c 0x4201⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5933073a16f5136279dc6aa8d7870f63e
SHA144963b41137642330f5286892cbaae4373748bb6
SHA256860e073f19bad7177ee2afed0a6c1a575eaffb446d1afe30e4f86e25b883fe56
SHA5129276f0b28b518f4f492b39601333fa871d3005ee5f0efba97af782f024ba4d16e038257336b3774d376b8acc43ee8a2ce17cf4bda0141679729f3148899204f2
-
Filesize
6KB
MD5b87b6b7161373983206029baf0634f5d
SHA11ef464f8dabe32f8c4e63ca7de3cafb44e5737bd
SHA2567b045df5b72cb8ba36083b221e3e7f8c7d12407319c9ef36a5a318bb4b746076
SHA512e4d1f9f9536fd5d849eb48dc6d994d0df58265228c89514f3d4e4d5b619139bde89f307bf5f8567bc7685c83ecf05a36cc7231a845fb3c813783b94863cbb867
-
Filesize
2.4MB
MD588905cc2e04013d7b68c50f1ddbf98af
SHA1cfab92dc093ffc07e05fa6c2a62e41415d10e816
SHA256f9b8d81302222d0af4e91e290519de28112ffaa36174094f64dceaa5098a8874
SHA5121c5a20e1f780de0bc8b188c086fe753cfdc25c53e5bd4c38c0b809409df07c08b9e6cf00dee024247a57a8bcb31cd3ad2cc5f8396a4000f1303c4b0b471dfafc
-
Filesize
2.1MB
MD5b9354ae39570caa81b778c4fc69ff889
SHA15fae4c09a3c6d3e8e028e5571b90852ff2f75200
SHA256809fcf88b3fd3f6f6d558ab3b703c0922e88d1775cc46027fe534030a88565f0
SHA5124737f21885c0e4cf38fa4e1b5429b7035362146fb23d6144af3adc49c395549b76f9f07b5f8f074ebbe110aa0529cc11b13400ce8127aa5f948c0fe91cf1f756
-
Filesize
1.4MB
MD5ea6a79a29d64db1049aef8cb7a0bbf87
SHA16e609e3a3b09a7462f7dbcc632e851a3442ba958
SHA2563353c603ca1d076a263ec95599c088d452762640f7581683c50c56a3ad56c110
SHA51278f339d09e8b3fbff4011a18f22c80c60e2d44d8c382c6d6b05b59118e17a77877120e4a319cbada6420f840d45bd473930a71d1f196237975e2590b8b2f95cd
-
Filesize
34KB
MD509974eaff6defadde38b1328754dbe09
SHA1001cfb5514444188e455b97acc369f037079ca9d
SHA2569eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7
SHA512da29b01ebebb454c004420c6b29bb8dca9fb50554a7a5db30035a5ec458d766049bf5502f708bf7eb210a4f9cbdb308cc0c8dcdad9f745b01a9e4f1455bbc846
-
Filesize
2.6MB
MD5530ea60c44c9c25b06bbf69a5a2cad28
SHA1216c3aa66e621eb7001675fd0c2a4d5a70afb659
SHA25602319057240ae5835cea2b2233ca113758dc573ee4a360a3f29c295538c2cb0f
SHA5126af5a8a03ab69a818641da3141b579694e6cfa4394cc0e41239fb8e641a622b48849f25af1166e939498b3150ad7964ae7537870cecb9ccac813909f0a4e4978
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
112KB
-
Filesize
196KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
196KB
