Analysis
- max time kernel
92s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 06:41
General
- Target c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0.exe
- Size 2.3MB
- Sample240607-hfqs8acf53
- SHA256 c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 7 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0.exe"C:\Users\Admin\AppData\Local\Temp\c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0.exe"C:\Users\Admin\AppData\Local\Temp\c05ab9496876974558c2aa90991698be730d43dcfe9d2cc332360cd88f1dd3f0.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
IntelGFX.exe.manifest
_ctypes.pyd
_socket.pyd
_sqlite3.pyd
python27.dll
python27.dll
pywintypes27.dll
sqlite3.dll
win32crypt.pyd
memory/2176-43-0x00000000757E0000-0x00000000757FE000-memory.dmp
memory/2176-45-0x000000001E980000-0x000000001E9A1000-memory.dmp
memory/2176-42-0x00000000758B0000-0x0000000075B61000-memory.dmp
memory/2176-37-0x0000000075710000-0x00000000757A0000-memory.dmp
memory/2176-36-0x00000000757A0000-0x00000000757B5000-memory.dmp
memory/2176-44-0x00000000757C0000-0x00000000757D1000-memory.dmp
memory/2176-32-0x000000001E7A0000-0x000000001E7C7000-memory.dmp
memory/2176-19-0x00000000758B0000-0x0000000075B61000-memory.dmp
memory/2176-46-0x000000001E7A0000-0x000000001E7C7000-memory.dmp
memory/2176-25-0x00000000757C0000-0x00000000757D1000-memory.dmp
memory/2176-24-0x00000000757E0000-0x00000000757FE000-memory.dmp
memory/2176-47-0x00000000757A0000-0x00000000757B5000-memory.dmp
memory/2176-48-0x0000000075710000-0x00000000757A0000-memory.dmp
memory/2176-29-0x000000001E980000-0x000000001E9A1000-memory.dmp