Resubmissions
17/04/2024, 14:47
240417-r6de9acg591017/04/2024, 14:47
240417-r6ctqaec2s1017/04/2024, 14:47
240417-r6az5acg561017/04/2024, 14:47
240417-r6apcseb9z1017/04/2024, 14:47
240417-r59gascg541015/04/2024, 13:15
240415-qhmtcahe7v1010/04/2024, 08:18
240410-j7smkacd9y1010/04/2024, 08:18
240410-j7r12ahc481010/04/2024, 08:18
240410-j7q4qshc461010/04/2024, 08:17
240410-j6pvaahc2810Analysis
- max time kernel
1198s - max time network
1199s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
17/04/2024, 14:47
General
- Target b960516dbba002bdd037ada7f1b06a5b.exe
- Size 7.2MB
- Sample240417-r6ctqaec2s
- SHA256 7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 41 IoCs
- Loads dropped DLL 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 20 IoCs
- Looks up external IP address via web service 25 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 52 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: RenamesItself 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b960516dbba002bdd037ada7f1b06a5b.exe"C:\Users\Admin\AppData\Local\Temp\b960516dbba002bdd037ada7f1b06a5b.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe"C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cached-certs
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
system32.exe
torrc
zlib1.dll
memory/564-278-0x00000000738B0000-0x00000000738F9000-memory.dmp
memory/564-307-0x0000000072310000-0x00000000723DE000-memory.dmp
memory/564-282-0x0000000072310000-0x00000000723DE000-memory.dmp
memory/564-297-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/564-283-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/564-280-0x0000000073430000-0x00000000734B8000-memory.dmp
memory/564-306-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/564-279-0x0000000073880000-0x00000000738A4000-memory.dmp
memory/564-277-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/564-281-0x00000000723E0000-0x00000000724EA000-memory.dmp
memory/564-309-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/1292-265-0x0000000073880000-0x00000000738A4000-memory.dmp
memory/1292-249-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/1292-263-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/1292-262-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/1292-261-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/1292-260-0x0000000073430000-0x00000000734B8000-memory.dmp
memory/1292-259-0x00000000723E0000-0x00000000724EA000-memory.dmp
memory/1292-258-0x00000000738B0000-0x00000000738F9000-memory.dmp
memory/1292-246-0x00000000723E0000-0x00000000724EA000-memory.dmp
memory/1292-264-0x0000000072310000-0x00000000723DE000-memory.dmp
memory/1292-248-0x0000000073430000-0x00000000734B8000-memory.dmp
memory/1292-244-0x0000000073880000-0x00000000738A4000-memory.dmp
memory/1292-241-0x0000000072310000-0x00000000723DE000-memory.dmp
memory/1292-243-0x00000000738B0000-0x00000000738F9000-memory.dmp
memory/1292-239-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/1332-329-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/1332-331-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/2340-55-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-133-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-18-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-29-0x0000000073D30000-0x0000000073DFE000-memory.dmp
memory/2340-24-0x0000000073E00000-0x0000000073EC8000-memory.dmp
memory/2340-39-0x0000000073CB0000-0x0000000073CD4000-memory.dmp
memory/2340-40-0x0000000073BA0000-0x0000000073CAA000-memory.dmp
memory/2340-41-0x0000000073B10000-0x0000000073B98000-memory.dmp
memory/2340-42-0x0000000000B60000-0x0000000000BE8000-memory.dmp
memory/2340-43-0x0000000001520000-0x00000000017EF000-memory.dmp
memory/2340-44-0x0000000073840000-0x0000000073B0F000-memory.dmp
memory/2340-45-0x0000000073CE0000-0x0000000073D29000-memory.dmp
memory/2340-47-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-48-0x0000000073E00000-0x0000000073EC8000-memory.dmp
memory/2340-49-0x0000000073D30000-0x0000000073DFE000-memory.dmp
memory/2340-56-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-64-0x0000000000B60000-0x0000000000BE8000-memory.dmp
memory/2340-81-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-100-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2340-118-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2812-184-0x0000000073880000-0x00000000738A4000-memory.dmp
memory/2812-197-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/2812-178-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2812-180-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/2812-179-0x0000000073900000-0x0000000073BCF000-memory.dmp
memory/2812-245-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2812-181-0x00000000738B0000-0x00000000738F9000-memory.dmp
memory/2812-187-0x00000000723E0000-0x00000000724EA000-memory.dmp
memory/2812-189-0x0000000072310000-0x00000000723DE000-memory.dmp
memory/2812-188-0x0000000073430000-0x00000000734B8000-memory.dmp
memory/2812-212-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/2812-198-0x00000000734C0000-0x0000000073588000-memory.dmp
memory/2812-196-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/3992-0-0x00000000748B0000-0x00000000748EC000-memory.dmp
memory/3992-114-0x0000000074880000-0x00000000748BC000-memory.dmp
memory/3992-321-0x0000000073510000-0x000000007354C000-memory.dmp
memory/3992-308-0x00000000748B0000-0x00000000748EC000-memory.dmp
memory/3992-166-0x0000000073CB0000-0x0000000073CEC000-memory.dmp
memory/3992-46-0x0000000073510000-0x000000007354C000-memory.dmp
memory/4636-149-0x0000000073840000-0x0000000073B0F000-memory.dmp
memory/4636-155-0x0000000073CB0000-0x0000000073CD4000-memory.dmp
memory/4636-163-0x0000000073CB0000-0x0000000073CD4000-memory.dmp
memory/4636-151-0x0000000073E00000-0x0000000073EC8000-memory.dmp
memory/4636-164-0x0000000073BA0000-0x0000000073CAA000-memory.dmp
memory/4636-152-0x0000000073D30000-0x0000000073DFE000-memory.dmp
memory/4636-154-0x0000000073CE0000-0x0000000073D29000-memory.dmp
memory/4636-147-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/4636-156-0x0000000000D10000-0x0000000001114000-memory.dmp
memory/4636-158-0x0000000073840000-0x0000000073B0F000-memory.dmp
memory/4636-159-0x0000000073B10000-0x0000000073B98000-memory.dmp
memory/4636-157-0x0000000073BA0000-0x0000000073CAA000-memory.dmp
memory/4636-160-0x0000000073E00000-0x0000000073EC8000-memory.dmp
memory/4636-161-0x0000000073D30000-0x0000000073DFE000-memory.dmp
memory/4636-162-0x0000000073CE0000-0x0000000073D29000-memory.dmp