Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
14/04/2024, 10:38
General
- Target d151ec74b0a409363d9401eeb348efaa.exe
- Size 7.8MB
- Sample240414-mprt4aah71
- SHA256 def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 49 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
dllhost.exe
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
memory/1368-145-0x0000000073390000-0x000000007345E000-memory.dmp
memory/1368-144-0x0000000073570000-0x00000000735F8000-memory.dmp
memory/1368-140-0x0000000073650000-0x0000000073674000-memory.dmp
memory/1368-141-0x0000000073680000-0x000000007394F000-memory.dmp
memory/1368-128-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1368-142-0x0000000073460000-0x000000007356A000-memory.dmp
memory/1368-143-0x0000000073950000-0x0000000073A18000-memory.dmp
memory/1368-139-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1368-137-0x0000000073600000-0x0000000073649000-memory.dmp
memory/1368-135-0x0000000073390000-0x000000007345E000-memory.dmp
memory/1368-132-0x0000000073950000-0x0000000073A18000-memory.dmp
memory/1368-130-0x0000000073680000-0x000000007394F000-memory.dmp
memory/1768-40-0x0000000073950000-0x0000000073A18000-memory.dmp
memory/1768-38-0x0000000073570000-0x00000000735F8000-memory.dmp
memory/1768-108-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-100-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-92-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-76-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-75-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-69-0x0000000073680000-0x000000007394F000-memory.dmp
memory/1768-67-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-117-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-41-0x0000000073390000-0x000000007345E000-memory.dmp
memory/1768-27-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/1768-32-0x0000000073680000-0x000000007394F000-memory.dmp
memory/1768-33-0x0000000073650000-0x0000000073674000-memory.dmp
memory/1768-39-0x0000000073460000-0x000000007356A000-memory.dmp
memory/1768-37-0x0000000073600000-0x0000000073649000-memory.dmp
memory/3272-228-0x0000000073600000-0x0000000073624000-memory.dmp
memory/3272-239-0x0000000073390000-0x000000007345E000-memory.dmp
memory/3272-244-0x0000000073680000-0x0000000073748000-memory.dmp
memory/3272-243-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/3272-242-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3272-240-0x0000000073630000-0x0000000073679000-memory.dmp
memory/3272-241-0x0000000073600000-0x0000000073624000-memory.dmp
memory/3272-226-0x0000000073630000-0x0000000073679000-memory.dmp
memory/3272-231-0x0000000073460000-0x00000000734E8000-memory.dmp
memory/3272-229-0x00000000734F0000-0x00000000735FA000-memory.dmp
memory/3272-218-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3272-220-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/3272-222-0x0000000073680000-0x0000000073748000-memory.dmp
memory/3272-224-0x0000000073390000-0x000000007345E000-memory.dmp
memory/3412-316-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3412-317-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/3412-293-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/3412-295-0x0000000073680000-0x0000000073748000-memory.dmp
memory/3412-297-0x00000000735B0000-0x000000007367E000-memory.dmp
memory/3412-314-0x0000000073420000-0x000000007352A000-memory.dmp
memory/3412-315-0x0000000073390000-0x0000000073418000-memory.dmp
memory/3412-299-0x0000000073560000-0x00000000735A9000-memory.dmp
memory/3412-301-0x0000000073530000-0x0000000073554000-memory.dmp
memory/3412-303-0x0000000073420000-0x000000007352A000-memory.dmp
memory/3412-304-0x0000000073390000-0x0000000073418000-memory.dmp
memory/3480-256-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3480-305-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3480-260-0x00000000735B0000-0x000000007367E000-memory.dmp
memory/3480-261-0x0000000073560000-0x00000000735A9000-memory.dmp
memory/3480-262-0x0000000073530000-0x0000000073554000-memory.dmp
memory/3480-263-0x0000000073420000-0x000000007352A000-memory.dmp
memory/3480-264-0x0000000073390000-0x0000000073418000-memory.dmp
memory/3480-266-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/3480-277-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/3480-259-0x0000000073680000-0x0000000073748000-memory.dmp
memory/3568-0-0x0000000074400000-0x000000007443C000-memory.dmp
memory/3568-50-0x0000000072F70000-0x0000000072FAC000-memory.dmp
memory/4448-195-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/4448-170-0x00000000734F0000-0x00000000735FA000-memory.dmp
memory/4448-173-0x0000000073390000-0x000000007345E000-memory.dmp
memory/4448-171-0x0000000073460000-0x00000000734E8000-memory.dmp
memory/4448-169-0x0000000073600000-0x0000000073624000-memory.dmp
memory/4448-168-0x0000000073630000-0x0000000073679000-memory.dmp
memory/4448-179-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/4448-166-0x0000000073750000-0x0000000073A1F000-memory.dmp
memory/4448-167-0x0000000073680000-0x0000000073748000-memory.dmp
memory/4448-161-0x00000000001C0000-0x00000000005C4000-memory.dmp
memory/4448-225-0x00000000001C0000-0x00000000005C4000-memory.dmp