Analysis
- max time kernel
148s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
14/04/2024, 10:38
General
- Target d151ec74b0a409363d9401eeb348efaa.exe
- Size 7.8MB
- Sample240414-mprt4aah71
- SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 41 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
cached-microdescs.new
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
dllhost.exe
memory/312-287-0x00000000738C0000-0x000000007398E000-memory.dmp
memory/312-288-0x0000000074580000-0x00000000745A4000-memory.dmp
memory/312-289-0x0000000073990000-0x0000000073C5F000-memory.dmp
memory/312-285-0x0000000074640000-0x000000007474A000-memory.dmp
memory/312-282-0x0000000000380000-0x0000000000784000-memory.dmp
memory/312-286-0x00000000745B0000-0x0000000074638000-memory.dmp
memory/312-284-0x0000000074750000-0x0000000074818000-memory.dmp
memory/312-283-0x0000000074820000-0x0000000074869000-memory.dmp
memory/1804-190-0x0000000073A80000-0x0000000073B8A000-memory.dmp
memory/1804-173-0x0000000073920000-0x00000000739EE000-memory.dmp
memory/1804-192-0x0000000073920000-0x00000000739EE000-memory.dmp
memory/1804-191-0x00000000739F0000-0x0000000073A78000-memory.dmp
memory/1804-203-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-189-0x0000000073B90000-0x0000000073C58000-memory.dmp
memory/1804-247-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-174-0x0000000074C90000-0x0000000074CB4000-memory.dmp
memory/1804-195-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-186-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-165-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-166-0x0000000074550000-0x0000000074599000-memory.dmp
memory/1804-167-0x0000000073B90000-0x0000000073C58000-memory.dmp
memory/1804-168-0x0000000073A80000-0x0000000073B8A000-memory.dmp
memory/1804-169-0x00000000739F0000-0x0000000073A78000-memory.dmp
memory/1804-170-0x00000000745A0000-0x000000007486F000-memory.dmp
memory/1804-204-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/1804-188-0x0000000074550000-0x0000000074599000-memory.dmp
memory/1804-187-0x00000000745A0000-0x000000007486F000-memory.dmp
memory/2400-131-0x0000000000BC0000-0x0000000000FC4000-memory.dmp
memory/2400-139-0x0000000074500000-0x00000000745CE000-memory.dmp
memory/2400-142-0x0000000074DB0000-0x0000000074DD4000-memory.dmp
memory/2400-140-0x00000000746E0000-0x00000000747A8000-memory.dmp
memory/2400-137-0x0000000074D10000-0x0000000074D59000-memory.dmp
memory/2400-136-0x0000000074C80000-0x0000000074D08000-memory.dmp
memory/2400-133-0x00000000745D0000-0x00000000746DA000-memory.dmp
memory/2400-134-0x00000000747B0000-0x0000000074A7F000-memory.dmp
memory/2400-130-0x00000000746E0000-0x00000000747A8000-memory.dmp
memory/2400-128-0x0000000074D10000-0x0000000074D59000-memory.dmp
memory/2400-125-0x00000000747B0000-0x0000000074A7F000-memory.dmp
memory/2516-234-0x00000000745A0000-0x000000007486F000-memory.dmp
memory/2516-251-0x0000000073B90000-0x0000000073C58000-memory.dmp
memory/2516-259-0x0000000074C90000-0x0000000074CB4000-memory.dmp
memory/2516-255-0x00000000739F0000-0x0000000073A78000-memory.dmp
memory/2516-258-0x00000000745A0000-0x000000007486F000-memory.dmp
memory/2516-257-0x0000000073920000-0x00000000739EE000-memory.dmp
memory/2516-256-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2516-271-0x0000000074C90000-0x0000000074CB4000-memory.dmp
memory/2516-253-0x0000000073A80000-0x0000000073B8A000-memory.dmp
memory/2516-237-0x0000000074550000-0x0000000074599000-memory.dmp
memory/2516-231-0x0000000000E20000-0x0000000001224000-memory.dmp
memory/2684-260-0x0000000004980000-0x000000000498A000-memory.dmp
memory/2684-84-0x0000000000E30000-0x0000000000E3A000-memory.dmp
memory/2684-212-0x0000000004980000-0x000000000498A000-memory.dmp
memory/2684-230-0x0000000005AB0000-0x0000000005EB4000-memory.dmp
memory/2684-16-0x0000000004100000-0x0000000004504000-memory.dmp
memory/2684-280-0x0000000005AB0000-0x0000000005EB4000-memory.dmp
memory/2684-194-0x0000000004980000-0x000000000498A000-memory.dmp
memory/2684-43-0x0000000004100000-0x0000000004504000-memory.dmp
memory/2684-281-0x0000000005AB0000-0x0000000005EB4000-memory.dmp
memory/2684-300-0x00000000048C0000-0x00000000048CA000-memory.dmp
memory/2684-150-0x00000000059A0000-0x0000000005DA4000-memory.dmp
memory/2684-116-0x00000000059A0000-0x0000000005DA4000-memory.dmp
memory/2684-147-0x0000000000E30000-0x0000000000E3A000-memory.dmp
memory/2684-148-0x0000000000E30000-0x0000000000E3A000-memory.dmp
memory/2684-149-0x0000000004980000-0x000000000498A000-memory.dmp
memory/2684-261-0x0000000004980000-0x000000000498A000-memory.dmp
memory/2684-262-0x00000000048C0000-0x00000000048CA000-memory.dmp
memory/3008-69-0x00000000747B0000-0x0000000074A7F000-memory.dmp
memory/3008-42-0x0000000074DB0000-0x0000000074DD4000-memory.dmp
memory/3008-68-0x0000000000BC0000-0x0000000000FC4000-memory.dmp
memory/3008-41-0x0000000074500000-0x00000000745CE000-memory.dmp
memory/3008-40-0x0000000074C80000-0x0000000074D08000-memory.dmp
memory/3008-39-0x00000000745D0000-0x00000000746DA000-memory.dmp
memory/3008-38-0x00000000746E0000-0x00000000747A8000-memory.dmp
memory/3008-37-0x0000000074D10000-0x0000000074D59000-memory.dmp
memory/3008-34-0x00000000747B0000-0x0000000074A7F000-memory.dmp
memory/3008-32-0x0000000000BC0000-0x0000000000FC4000-memory.dmp
memory/3008-76-0x0000000000BC0000-0x0000000000FC4000-memory.dmp
memory/3008-100-0x0000000000BC0000-0x0000000000FC4000-memory.dmp
memory/3008-109-0x0000000000BC0000-0x0000000000FC4000-memory.dmp