Analysis
- max time kernel
150s - max time network
153s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
14/04/2024, 10:38
General
- Target d151ec74b0a409363d9401eeb348efaa.exe
- Size 7.8MB
- Sample240414-mprt4aah71
- SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 51 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libssl-1_1.dll
torrc
zlib1.dll
libgcc_s_sjlj-1.dll
libssp-0.dll
libwinpthread-1.dll
memory/204-268-0x0000000072EB0000-0x0000000072FBA000-memory.dmp
memory/204-264-0x0000000073040000-0x0000000073108000-memory.dmp
memory/204-269-0x0000000072E20000-0x0000000072EA8000-memory.dmp
memory/204-270-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/204-316-0x0000000000120000-0x0000000000524000-memory.dmp
memory/204-271-0x0000000072D50000-0x0000000072E1E000-memory.dmp
memory/204-267-0x0000000072FC0000-0x0000000072FE4000-memory.dmp
memory/204-266-0x0000000072FF0000-0x0000000073039000-memory.dmp
memory/204-285-0x0000000000120000-0x0000000000524000-memory.dmp
memory/204-263-0x0000000000120000-0x0000000000524000-memory.dmp
memory/204-286-0x0000000073040000-0x0000000073108000-memory.dmp
memory/204-295-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/204-296-0x0000000072D50000-0x0000000072E1E000-memory.dmp
memory/316-33-0x00000000731F0000-0x0000000073239000-memory.dmp
memory/316-74-0x0000000001B90000-0x0000000001C18000-memory.dmp
memory/316-82-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-95-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-111-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-73-0x0000000001B90000-0x0000000001E5F000-memory.dmp
memory/316-120-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-129-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-72-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-64-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-49-0x0000000072EF0000-0x00000000731BF000-memory.dmp
memory/316-46-0x0000000073240000-0x000000007330E000-memory.dmp
memory/316-45-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/316-44-0x0000000000120000-0x0000000000524000-memory.dmp
memory/316-42-0x0000000001B90000-0x0000000001C18000-memory.dmp
memory/316-41-0x0000000072D50000-0x0000000072DD8000-memory.dmp
memory/316-40-0x0000000072DE0000-0x0000000072EEA000-memory.dmp
memory/316-39-0x0000000001B90000-0x0000000001E5F000-memory.dmp
memory/316-35-0x0000000072EF0000-0x00000000731BF000-memory.dmp
memory/316-34-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/316-32-0x0000000073240000-0x000000007330E000-memory.dmp
memory/316-31-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/316-16-0x0000000000120000-0x0000000000524000-memory.dmp
memory/1488-251-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/1488-242-0x0000000072EB0000-0x0000000072FBA000-memory.dmp
memory/1488-252-0x0000000073040000-0x0000000073108000-memory.dmp
memory/1488-250-0x0000000000120000-0x0000000000524000-memory.dmp
memory/1488-245-0x0000000072E20000-0x0000000072EA8000-memory.dmp
memory/1488-230-0x0000000073040000-0x0000000073108000-memory.dmp
memory/1488-240-0x0000000072FC0000-0x0000000072FE4000-memory.dmp
memory/1488-226-0x0000000000120000-0x0000000000524000-memory.dmp
memory/1488-228-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/1488-233-0x0000000072D50000-0x0000000072E1E000-memory.dmp
memory/1488-237-0x0000000072FF0000-0x0000000073039000-memory.dmp
memory/4216-307-0x0000000072D50000-0x0000000072E1E000-memory.dmp
memory/4216-310-0x0000000072FC0000-0x0000000072FE4000-memory.dmp
memory/4216-301-0x0000000000120000-0x0000000000524000-memory.dmp
memory/4216-308-0x0000000072FF0000-0x0000000073039000-memory.dmp
memory/4216-304-0x0000000073040000-0x0000000073108000-memory.dmp
memory/4216-312-0x0000000072E20000-0x0000000072EA8000-memory.dmp
memory/4216-302-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/4216-314-0x0000000072EB0000-0x0000000072FBA000-memory.dmp
memory/4248-171-0x0000000073040000-0x0000000073108000-memory.dmp
memory/4248-173-0x0000000072FC0000-0x0000000072FE4000-memory.dmp
memory/4248-181-0x0000000073110000-0x00000000733DF000-memory.dmp
memory/4248-176-0x0000000072EB0000-0x0000000072FBA000-memory.dmp
memory/4248-180-0x0000000072D50000-0x0000000072E1E000-memory.dmp
memory/4248-179-0x0000000072E20000-0x0000000072EA8000-memory.dmp
memory/4248-172-0x0000000072FF0000-0x0000000073039000-memory.dmp
memory/4248-205-0x0000000000120000-0x0000000000524000-memory.dmp
memory/4248-206-0x0000000073040000-0x0000000073108000-memory.dmp
memory/4248-243-0x0000000000120000-0x0000000000524000-memory.dmp
memory/4256-150-0x0000000072EF0000-0x00000000731BF000-memory.dmp
memory/4256-141-0x00000000731F0000-0x0000000073239000-memory.dmp
memory/4256-139-0x0000000073240000-0x000000007330E000-memory.dmp
memory/4256-143-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/4256-145-0x0000000072DE0000-0x0000000072EEA000-memory.dmp
memory/4256-148-0x0000000072D50000-0x0000000072DD8000-memory.dmp
memory/4256-152-0x0000000000120000-0x0000000000524000-memory.dmp
memory/4256-154-0x0000000073310000-0x00000000733D8000-memory.dmp
memory/4256-155-0x0000000073240000-0x000000007330E000-memory.dmp
memory/4256-157-0x00000000731C0000-0x00000000731E4000-memory.dmp
memory/4260-119-0x0000000072490000-0x00000000724CA000-memory.dmp
memory/4260-0-0x0000000073CF0000-0x0000000073D2A000-memory.dmp
memory/4260-43-0x0000000072A60000-0x0000000072A9A000-memory.dmp