8ac24d9c7d67bab07b3733368b2490b6597f210a754950efbc3d4fd29a1368b9

Resubmissions

07/07/2024, 21:58

240707-1vfwns1dqa10

07/07/2024, 21:56

240707-1tel8ayflm10

Analysis

max time kernel
45s
max time network
17s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activator.exe
Size 12.5MB
Sample240707-1tel8ayflm
SHA256 8ac24d9c7d67bab07b3733368b2490b6597f210a754950efbc3d4fd29a1368b9
MD5 6e47bea9ab90932d7b7dc87b25595a10
SHA1 abd8699cf93c07a85569d25d8ffb93245baedd77
SHA512 8fc81451fd67de521582b6545505fd39450e18f84ae16f637cfe6609f77c359c7b688b1c93bd8a41449640e81d7e4664ad1482e57b5e2aec85e4a0c6cf018654
SSDEEP 196608:Otvlimxx+hKFCjTO/62WtaEJ2Hsx8tn2s03nfz1HkFsnP1PibIYxpkn+9D3pdks:ovgf58Y1husnP1WuQpdks
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000173e7-44.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2576	Activator.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-45-0x0000000073F80000-0x0000000074490000-memory.dmp	upx
behavioral1/files/0x00060000000173e7-44.dat	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2576	1732	Activator.exe	28
PID 1732 wrote to memory of 2576	1732	Activator.exe	28
PID 1732 wrote to memory of 2576	1732	Activator.exe	28
PID 1732 wrote to memory of 2576	1732	Activator.exe	28

C:\Users\Admin\AppData\Local\Temp\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Activator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Activator.exe"
  2⤵
  - Loads dropped DLL
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

python311.dll

Path \Users\Admin\AppData\Local\Temp\_MEI17322\python311.dll
Size 1.4MB
SHA256 de9b346a0a8aedcfa3ca53f63c95a549595fc49a7ac8b7d41e849b6157980867
MD5 df88f8e8a13f7026ca3d7cfcbe0f7899
SHA1 4431e70e6d2911096852eccbb95b3015cdc7b129
SHA512 ebec07cdd71a70a9f56413e9e7868d2bdd81d0e369bd9bc923ee1a8821f9c34983cf9391e0e154d647df566fe0dcd261c72c5c5eab974d570ff25e38c7635f5f
SSDEEP 24576:x4DCSBYIUOToSBTRNsbWzivAmBOJUZShi0e+f8wtL9XPIJxDBrepFcQlryeegfJ2:x4DC+YI7T3dRNMW2BOJUcQ0e+ttL9XAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2576-45-0x0000000073F80000-0x0000000074490000-memory.dmp

Download