Overview

overview

10

Static

static

10

Activator.exe

windows7-x64

7

Activator.exe

windows10-2004-x64

7

Resubmissions

07/07/2024, 21:58

240707-1vfwns1dqa10

07/07/2024, 21:56

240707-1tel8ayflm10

Analysis

  • max time kernel
    45s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 21:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Activator.exe
  • Size 12.5MB
  • Sample240707-1tel8ayflm
  • SHA256 8ac24d9c7d67bab07b3733368b2490b6597f210a754950efbc3d4fd29a1368b9
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 20 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 6 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Activator.exe
    "C:\Users\Admin\AppData\Local\Temp\Activator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Users\Admin\AppData\Local\Temp\Activator.exe
      "C:\Users\Admin\AppData\Local\Temp\Activator.exe"
      2⤵
      • Loads dropped DLL
      PID:1328

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\VCRUNTIME140.dll
        • Size 88KB
        • SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_asyncio.pyd
        • Size 33KB
        • SHA256 866f9ba34068dff5f0fad7d2c2bcb2cac2136632aadf06df6451aa734ee0a32f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_bz2.pyd
        • Size 44KB
        • SHA256 3ace8490f5d9c64e79d696d1a4e9692ca12ee53831396fb31b9692f97543ccc0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_ctypes.pyd
        • Size 52KB
        • SHA256 de95f33e0211eeb9e0a9246986bc9c5cb9e712e884f93fcfafab34449ed67ca1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_decimal.pyd
        • Size 79KB
        • SHA256 7487f629c1e89fca8870a292fcb88bfa7cd3be72bab5b220736271db1e80d869
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_hashlib.pyd
        • Size 30KB
        • SHA256 dc02966b8c79d14d9d7753cbb12c5412f88c601bc63a4287d9a1eb6f7bfb6b1d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_lzma.pyd
        • Size 79KB
        • SHA256 d113eeecb5e57893ca135175cd7483126b5e43a904fba38a886c2021bf94f8eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_multiprocessing.pyd
        • Size 25KB
        • SHA256 7a1f068e743bc8e60dd13c46e96aaf638ec09f3adda95ab755cb9a152cb5b88d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_overlapped.pyd
        • Size 29KB
        • SHA256 fdceb1ecfcab79a295e57b3cf0b5c16b8fb0bcf9549494afd1d9abd9f7219504
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_queue.pyd
        • Size 24KB
        • SHA256 8deccb8bad06a3d7cc016e13e1d3a1fcfdf84f5970160a1e74db7d5c6c5e2d1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_socket.pyd
        • Size 38KB
        • SHA256 f6b7893c7ccd58b7275cb9ca9e5f3dbc8169fac80c1db978508bf818359f87b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_sqlite3.pyd
        • Size 44KB
        • SHA256 7d7e5cca2bfe9b6728f45cae0440f9d593ce1e972cf21d0c678d36f99dfd36be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_ssl.pyd
        • Size 61KB
        • SHA256 c8032e9cfb4ab80f64a5b33d779e2bce14d91bd1a543ff4a1a41fb5732d9843c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\base_library.zip
        • Size 1.4MB
        • SHA256 f9c5fdc929a36e519ec6a0a3d9f9a4f3358105640bdb71d98de7fb395542b8c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        crypto_clipper.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\crypto_clipper.json
        • Size 155B
        • SHA256 3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7
        • MD5 SHA1 SHA512
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libcrypto-3.dll
        • Size 1023KB
        • SHA256 813328a96b3d907770e5a34333b042c301e3c5ad21711b8e0a82b2cfd264debf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libffi-8.dll
        • Size 28KB
        • SHA256 97ccb8542e8bbaf8c949683e8aba21b85e496a237c5543f8b2f6d90d9855b389
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libopus-0.x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libopus-0.x64.dll
        • Size 217KB
        • SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libssl-3.dll
        • Size 190KB
        • SHA256 80720807204e840c63ade6b4425a5e6e2f6e2b5fbae95260307bebf2ac7fb027
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pyexpat.pyd
        • Size 71KB
        • SHA256 e685c7061ecf13184ee7c11ef405cbccba7e6f7b2b9ff169fcb7747236b65b27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\python311.dll
        • Size 1.4MB
        • SHA256 de9b346a0a8aedcfa3ca53f63c95a549595fc49a7ac8b7d41e849b6157980867
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\select.pyd
        • Size 24KB
        • SHA256 58f3b7be63f84f6a78bd86c3e6dcbe43cc2d1e348d514cdd61f88daebac2b9ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\sqlite3.dll
        • Size 505KB
        • SHA256 4db6828ff91b31c2a49f9fe3144a21627686a67822e72d3e5649bc7122ba9823
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\unicodedata.pyd
        • Size 291KB
        • SHA256 43438380f07bdcfa795b610cf2de45159dd809ea63d178fb3e16ca4198fcdd84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1328-54-0x0000000074990000-0x000000007499D000-memory.dmp
        Download

        memory/1328-79-0x00000000749A0000-0x00000000749BE000-memory.dmp
        Download

        memory/1328-76-0x0000000074980000-0x0000000074990000-memory.dmp
        Download

        memory/1328-53-0x00000000749A0000-0x00000000749BE000-memory.dmp
        Download

        memory/1328-77-0x00000000745F0000-0x000000007497D000-memory.dmp
        Download

        memory/1328-78-0x00000000749F0000-0x0000000074F00000-memory.dmp
        Download

        memory/1328-81-0x0000000074980000-0x0000000074990000-memory.dmp
        Download

        memory/1328-47-0x00000000749F0000-0x0000000074F00000-memory.dmp
        Download

        memory/1328-82-0x00000000745F0000-0x000000007497D000-memory.dmp
        Download

        memory/1328-93-0x0000000074990000-0x000000007499D000-memory.dmp
        Download

        memory/1328-94-0x00000000749A0000-0x00000000749BE000-memory.dmp
        Download

        memory/1328-91-0x0000000074980000-0x0000000074990000-memory.dmp
        Download

        memory/1328-88-0x00000000749F0000-0x0000000074F00000-memory.dmp
        Download

        memory/1328-92-0x00000000745F0000-0x000000007497D000-memory.dmp
        Download