59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6

General

Target

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
Size

9.6MB
MD5

acbf4b85e79cebd64f71f96ab4e08edd
SHA1

41b7dfb70131b9fa7826345950624afd98bd9dd9
SHA256

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6
SHA512

137c1c44df642a686296b67a738e9242094c9c0fe6203b426d652522e7bd16dc24361d2cb8f55b484d5858303a5cf8ac1f471c83022c13e625c576dd9f27025b
SSDEEP

196608:9vdZfuYbS/XV5o/7xM7LRRm/zuKLvvxdF6TKKDas+rYn+KMTKbi:t3fcXV5ozaRSZLv5tZrsq2

Score

9^/10

oss_ak upx

Malware Config

Signatures

detect oss ak 5 IoCs

oss ak information detected.

oss_ak

Processes:

resource	yara_rule
behavioral2/memory/3220-10-0x0000000000400000-0x00000000018E0000-memory.dmp	detect_ak_stuff
behavioral2/memory/3220-12-0x0000000000400000-0x00000000018E0000-memory.dmp	detect_ak_stuff
behavioral2/memory/3220-13-0x0000000000400000-0x00000000018E0000-memory.dmp	detect_ak_stuff
behavioral2/memory/3220-21-0x0000000000400000-0x00000000018E0000-memory.dmp	detect_ak_stuff
behavioral2/memory/3220-30-0x0000000000400000-0x00000000018E0000-memory.dmp	detect_ak_stuff

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\libcurl.dll	acprotect

Loads dropped DLL 2 IoCs

Processes:

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

pid	process
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3220-14-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral2/memory/3220-20-0x00000000038C0000-0x00000000038CB000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\libcurl.dll	upx
behavioral2/memory/3220-27-0x00000000740C0000-0x000000007435B000-memory.dmp	upx
behavioral2/memory/3220-29-0x00000000740C0000-0x000000007435B000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

pid	process
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

pid	process
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
3220	59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

pid process

3220 59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe

C:\Users\Admin\AppData\Local\Temp\59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
"C:\Users\Admin\AppData\Local\Temp\59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\libcurl.dll
Filesize
1.2MB

MD5
cc73654317d0e52553f1f9e1bdbbc2f0

SHA1
8fe1fc72da9599a59392ea784fc89101a8057468

SHA256
3baf364955a64581f8984c9c76ca68a9a104f6747ee00fd2d2033a29edc84cbb

SHA512
35fa5c4ff9386c71403f74a4f6517bf6b31da264f56472ff58666e4617b75a86f0cd523e9460c3bafca7b04c6345d887982bec2b630ad214b79227a209f941d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\libmySQL.dll
Filesize
4.4MB

MD5
3f28377bfd63d619fda60a7603815045

SHA1
371a0d14786d58e0fa0da6828dbba74f8ae3fe01

SHA256
ac370863f8028f5ea32f51441f20f3c5b6f67ec338c7ff2ed4709e3939dad3fb

SHA512
f2a24659871013173645f475a6e650cfc6c48a06af9fdefd5b5733996b6eba31f2151957b3f193183b3a07b811a61ed2ea6bc8f55cba40e0ed05013a56d24dd0

Download Submit
memory/3220-12-0x0000000000400000-0x00000000018E0000-memory.dmp

Filesize
20.9MB

Download
memory/3220-14-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3220-6-0x00000000037C0000-0x00000000037C1000-memory.dmp

Filesize
4KB

Download
memory/3220-5-0x00000000036A0000-0x00000000036A1000-memory.dmp

Filesize
4KB

Download
memory/3220-4-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Filesize
4KB

Download
memory/3220-2-0x0000000001BB0000-0x0000000001BB1000-memory.dmp

Filesize
4KB

Download
memory/3220-1-0x0000000001A00000-0x0000000001A01000-memory.dmp

Filesize
4KB

Download
memory/3220-10-0x0000000000400000-0x00000000018E0000-memory.dmp

Filesize
20.9MB

Download
memory/3220-0-0x0000000000AFB000-0x0000000000F54000-memory.dmp

Filesize
4.3MB

Download
memory/3220-7-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/3220-8-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/3220-13-0x0000000000400000-0x00000000018E0000-memory.dmp

Filesize
20.9MB

Download
memory/3220-20-0x00000000038C0000-0x00000000038CB000-memory.dmp

Filesize
44KB

Download
memory/3220-21-0x0000000000400000-0x00000000018E0000-memory.dmp

Filesize
20.9MB

Download
memory/3220-3-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/3220-27-0x00000000740C0000-0x000000007435B000-memory.dmp

Filesize
2.6MB

Download
memory/3220-29-0x00000000740C0000-0x000000007435B000-memory.dmp

Filesize
2.6MB

Download
memory/3220-30-0x0000000000400000-0x00000000018E0000-memory.dmp

Filesize
20.9MB

Download
memory/3220-31-0x0000000000AFB000-0x0000000000F54000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads