Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/03/2024, 23:04

General

  • Target

    b352a4af44b3d6bab8c5314b02c75609.exe

  • Size

    65KB

  • MD5

    b352a4af44b3d6bab8c5314b02c75609

  • SHA1

    3dedfae4fa32f2e8a650eb3e6a543ae76c33baab

  • SHA256

    d6f423c9b73dc9e27de8a11629b5e46df6c4fba43f6894d90bf08924c06335ff

  • SHA512

    8748a979396de26d977fa0cfc85b9b28551933bd400d058783c8733f820663f83739ff10c52706655b605c85bdfa6e5a82a58bd33bce11d9402a51ad1e69c4ba

  • SSDEEP

    768:Ks3dVZ7Ytb8Q0JVZWJe/GUlxBKwf8WQAcTtw1rStD/YGJdHKD9qXLvfohSDnhBO9:KCvZ+o7EA/7jBKWZ11r/tSaSDjG

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b352a4af44b3d6bab8c5314b02c75609.exe
    "C:\Users\Admin\AppData\Local\Temp\b352a4af44b3d6bab8c5314b02c75609.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2248

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\T1dll.dll

          Filesize

          47KB

          MD5

          08a6d43bbc64739bb40f14a422efb024

          SHA1

          8ce97b85c23a74c0a93bf8a26b29b8feb4d7f8e8

          SHA256

          f309681d4f4ecf76402de3b8cf4045214728b727510277d7f8816a4e8c5c1249

          SHA512

          990b01a31de32c03fb7d31995d4cfa10534fc86c39e246e0cbb055a0fb7e8e1f540f1560809733d950f41c58ae0ed2c69e82fd42e0c2a575afb1942b868d4087

        • memory/2248-4-0x0000000000230000-0x0000000000252000-memory.dmp

          Filesize

          136KB

        • memory/2248-5-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2248-6-0x0000000000230000-0x0000000000252000-memory.dmp

          Filesize

          136KB