Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
14/04/2024, 10:38
General
- Target d151ec74b0a409363d9401eeb348efaa.exe
- Size 7.8MB
- Sample240414-mprt4aah71
- SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 30 IoCs
- UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/1352-0-0x00000000745E0000-0x0000000074619000-memory.dmp
memory/1352-198-0x0000000073300000-0x0000000073339000-memory.dmp
memory/1352-106-0x00000000741A0000-0x00000000741D9000-memory.dmp
memory/1352-46-0x0000000073090000-0x00000000730C9000-memory.dmp
memory/1820-248-0x0000000073A10000-0x0000000073A59000-memory.dmp
memory/1820-244-0x0000000073A60000-0x0000000073B28000-memory.dmp
memory/1820-256-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/1820-242-0x00000000734A0000-0x000000007376F000-memory.dmp
memory/1820-254-0x0000000073770000-0x00000000737F8000-memory.dmp
memory/1820-252-0x0000000073800000-0x000000007390A000-memory.dmp
memory/1820-250-0x0000000073910000-0x0000000073934000-memory.dmp
memory/1820-240-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/1820-246-0x0000000073940000-0x0000000073A0E000-memory.dmp
memory/1924-260-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/1924-268-0x00000000737A0000-0x0000000073868000-memory.dmp
memory/1924-270-0x0000000073720000-0x0000000073744000-memory.dmp
memory/1924-273-0x0000000073610000-0x000000007371A000-memory.dmp
memory/1924-274-0x0000000073580000-0x0000000073608000-memory.dmp
memory/1924-275-0x00000000734B0000-0x000000007357E000-memory.dmp
memory/1924-276-0x0000000073870000-0x0000000073B3F000-memory.dmp
memory/1924-277-0x0000000073750000-0x0000000073799000-memory.dmp
memory/4268-128-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-76-0x0000000001FD0000-0x000000000229F000-memory.dmp
memory/4268-33-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-36-0x0000000073800000-0x000000007390A000-memory.dmp
memory/4268-38-0x0000000001800000-0x0000000001888000-memory.dmp
memory/4268-37-0x0000000073770000-0x00000000737F8000-memory.dmp
memory/4268-35-0x0000000073910000-0x0000000073934000-memory.dmp
memory/4268-39-0x00000000734A0000-0x000000007376F000-memory.dmp
memory/4268-165-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-138-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-118-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-107-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-97-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-40-0x0000000001FD0000-0x000000000229F000-memory.dmp
memory/4268-42-0x0000000073A10000-0x0000000073A59000-memory.dmp
memory/4268-43-0x0000000073940000-0x0000000073A0E000-memory.dmp
memory/4268-34-0x0000000073A60000-0x0000000073B28000-memory.dmp
memory/4268-58-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-81-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-60-0x0000000073A60000-0x0000000073B28000-memory.dmp
memory/4268-75-0x0000000001800000-0x0000000001888000-memory.dmp
memory/4268-67-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-66-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4268-65-0x00000000734A0000-0x000000007376F000-memory.dmp
memory/4268-61-0x0000000073940000-0x0000000073A0E000-memory.dmp
memory/4496-163-0x00000000734A0000-0x000000007376F000-memory.dmp
memory/4496-237-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4496-202-0x0000000000FD0000-0x00000000013D4000-memory.dmp
memory/4496-201-0x0000000073940000-0x0000000073A0E000-memory.dmp
memory/4496-200-0x0000000073A60000-0x0000000073B28000-memory.dmp
memory/4496-199-0x00000000734A0000-0x000000007376F000-memory.dmp
memory/4496-170-0x0000000073770000-0x00000000737F8000-memory.dmp
memory/4496-169-0x0000000073800000-0x000000007390A000-memory.dmp
memory/4496-168-0x0000000073910000-0x0000000073934000-memory.dmp
memory/4496-167-0x0000000073A10000-0x0000000073A59000-memory.dmp
memory/4496-166-0x0000000073940000-0x0000000073A0E000-memory.dmp
memory/4496-164-0x0000000073A60000-0x0000000073B28000-memory.dmp