Analysis
- max time kernel
150s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
14/04/2024, 10:17
General
- Target 06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
- Size 7.8MB
- Sample240414-mbpgtaah2y
- SHA256 06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 30 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe"C:\Users\Admin\AppData\Local\Temp\06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe"C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe"C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe"C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe"C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus
cached-microdescs.new
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/1960-246-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/1960-269-0x0000000072020000-0x00000000720E8000-memory.dmp
memory/1960-257-0x0000000071E80000-0x0000000071F08000-memory.dmp
memory/1960-255-0x0000000073320000-0x0000000073344000-memory.dmp
memory/1960-251-0x0000000071DB0000-0x0000000071E7E000-memory.dmp
memory/1960-256-0x0000000071F10000-0x000000007201A000-memory.dmp
memory/1960-252-0x0000000073350000-0x0000000073399000-memory.dmp
memory/1960-249-0x0000000072020000-0x00000000720E8000-memory.dmp
memory/1960-266-0x0000000071DB0000-0x0000000071E7E000-memory.dmp
memory/1960-268-0x00000000733A0000-0x000000007366F000-memory.dmp
memory/1960-247-0x00000000733A0000-0x000000007366F000-memory.dmp
memory/1960-267-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/2880-171-0x00000000732E0000-0x00000000735AF000-memory.dmp
memory/2880-155-0x00000000732E0000-0x00000000735AF000-memory.dmp
memory/2880-165-0x00000000735B0000-0x0000000073638000-memory.dmp
memory/2880-172-0x00000000737D0000-0x0000000073898000-memory.dmp
memory/2880-161-0x0000000073750000-0x0000000073774000-memory.dmp
memory/2880-163-0x0000000073640000-0x000000007374A000-memory.dmp
memory/2880-159-0x0000000073780000-0x00000000737C9000-memory.dmp
memory/2880-158-0x00000000738A0000-0x000000007396E000-memory.dmp
memory/2880-157-0x00000000737D0000-0x0000000073898000-memory.dmp
memory/2880-152-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/2880-173-0x00000000738A0000-0x000000007396E000-memory.dmp
memory/2880-175-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/2880-174-0x0000000073780000-0x00000000737C9000-memory.dmp
memory/3704-254-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3704-188-0x0000000072020000-0x00000000720E8000-memory.dmp
memory/3704-189-0x0000000073350000-0x0000000073399000-memory.dmp
memory/3704-221-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3704-190-0x0000000073320000-0x0000000073344000-memory.dmp
memory/3704-191-0x0000000071F10000-0x000000007201A000-memory.dmp
memory/3704-192-0x0000000071E80000-0x0000000071F08000-memory.dmp
memory/3704-196-0x0000000071DB0000-0x0000000071E7E000-memory.dmp
memory/3704-198-0x00000000733A0000-0x000000007366F000-memory.dmp
memory/3704-222-0x0000000072020000-0x00000000720E8000-memory.dmp
memory/3876-24-0x00000000738A0000-0x000000007396E000-memory.dmp
memory/3876-65-0x0000000073780000-0x00000000737C9000-memory.dmp
memory/3876-129-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-115-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-107-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-18-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-37-0x00000000735B0000-0x0000000073638000-memory.dmp
memory/3876-98-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-90-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-89-0x00000000015B0000-0x000000000187F000-memory.dmp
memory/3876-88-0x00000000015B0000-0x0000000001638000-memory.dmp
memory/3876-87-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-79-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-70-0x00000000732E0000-0x00000000735AF000-memory.dmp
memory/3876-67-0x0000000073750000-0x0000000073774000-memory.dmp
memory/3876-137-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-63-0x00000000738A0000-0x000000007396E000-memory.dmp
memory/3876-64-0x00000000737D0000-0x0000000073898000-memory.dmp
memory/3876-62-0x0000000000860000-0x0000000000C64000-memory.dmp
memory/3876-39-0x00000000015B0000-0x000000000187F000-memory.dmp
memory/3876-40-0x00000000732E0000-0x00000000735AF000-memory.dmp
memory/3876-30-0x0000000073780000-0x00000000737C9000-memory.dmp
memory/3876-31-0x0000000073750000-0x0000000073774000-memory.dmp
memory/3876-38-0x00000000015B0000-0x0000000001638000-memory.dmp
memory/3876-43-0x0000000073640000-0x000000007374A000-memory.dmp
memory/3876-42-0x00000000737D0000-0x0000000073898000-memory.dmp
memory/4004-0-0x0000000074350000-0x000000007438C000-memory.dmp
memory/4004-46-0x0000000072EC0000-0x0000000072EFC000-memory.dmp
memory/4004-106-0x0000000074320000-0x000000007435C000-memory.dmp
memory/4004-176-0x0000000073750000-0x000000007378C000-memory.dmp