648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
Size

26.2MB
MD5

351be4df50a6172ac453f01bdd07da26
SHA1

6a6861eb03621fe2d3fff8de6cf6e00697be743f
SHA256

648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c
SHA512

537a889fc47fba48846c5f633cc85665156130d796b75086ec61f2600b8fe9284201c9b576bdc4f3cc57456559cd44a1e9ff4e7e4b8aec0a9b6ababeb61692d8
SSDEEP

786432:AmSroc1dxc//jYChIgW3a47FNNUaVtlbZytIyLMdoFs:Afoc1dxc//jYoIgW3a47FNNUItlb2

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002344f-15.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe

Deletes itself 1 IoCs

pid	Process
4752	Tomcat.exe

Executes dropped EXE 1 IoCs

pid	Process
4752	Tomcat.exe

Loads dropped DLL 2 IoCs

pid	Process
4752	Tomcat.exe
4752	Tomcat.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002344f-15.dat	upx
behavioral2/memory/4752-31-0x0000000002B30000-0x0000000002B48000-memory.dmp	upx
behavioral2/memory/4752-36-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomcat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe
4752	Tomcat.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	Tomcat.exe
Token: SeLockMemoryPrivilege	4752	Tomcat.exe
Token: SeCreateGlobalPrivilege	4752	Tomcat.exe
Token: SeBackupPrivilege	4752	Tomcat.exe
Token: SeRestorePrivilege	4752	Tomcat.exe
Token: SeShutdownPrivilege	4752	Tomcat.exe
Token: SeCreateTokenPrivilege	4752	Tomcat.exe
Token: SeTakeOwnershipPrivilege	4752	Tomcat.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
4752	Tomcat.exe
4752	Tomcat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4752	1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe	87
PID 1740 wrote to memory of 4752	1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe	87
PID 1740 wrote to memory of 4752	1740	648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe	87

C:\Users\Admin\AppData\Local\Temp\648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe
"C:\Users\Admin\AppData\Local\Temp\648e6365ab5ea773442e98445170065c6d05ae619216425161cf2dbb0a875f4c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\Documents\Tomcat.exe
  "C:\Users\Admin\Documents\Tomcat.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Ling\malloc\L_mimalloc.dll

Filesize
148KB

MD5
051d69a619adca3472e8d7c9b0c0eb5c

SHA1
6cc795ac90e43e408919e19ba6f5633863560459

SHA256
feefc12464985e2057a4cbd54117e9414f2e00a284106fa38b62d63052a1f7dd

SHA512
50daa3344aa4d86cdd22cf5736eec993467e6574c5e341cd0fd95757c739e167b6e76c744b29ae302d08c88d469fea0767640a9257f54f9dec2c5fbb87c23b71

Download Submit
C:\Users\Admin\AppData\Roaming\zlib.dll

Filesize
27KB

MD5
849e9f3e59daf750db838e885d58c6fa

SHA1
733cb105153e4b83160a52bfa2ddd95d750fb806

SHA256
f94949a6c121a525f661dd8abd917eb37a5cf582c89e3a258170a15d30cc0cc2

SHA512
3feff6db5fc5ae371a4ec60ce13a383668a5accac537a0ae56b9b5b7318a2d5bdb4b79286a519cad3610cb6d1f335a11c09a4d3165c147a00d5a7880ea23e173

Download Submit
C:\Users\Admin\Documents\Tomcat.exe

Filesize
2.0MB

MD5
807859bd08fd63f3daf098b3c6e9f688

SHA1
b5ca0e6b169eb837de4b01a948cdd3631a1ae889

SHA256
f592addde60cf8ad7936d5588b2b4a00badf885bbdd7e47272afd060875d7032

SHA512
cd67ee678f7d688a33d8e086c77db8b6a7745a028efd344a9b1e92d1108504239347789a2c0fe7396e5443148b870e280e1a5992b9ea3de277fea99b4f85bda4

Download Submit
C:\Users\Admin\Documents\conf.ini

Filesize
222B

MD5
f50ec35e2066f7b6f7d144041b61629d

SHA1
8054f839f9907a682e4c243561aaa3e82d79c975

SHA256
279124d8147a006df555a31b522713f359c056c02e75cbe249e6f9976a0ec7f5

SHA512
d2079dad9575cd9260652680935dc0a6fd17df8fdf20ed55177e64e373960dfb66da102541e166d03e3b760cdd6251d883d109fb46e185972aec8ab9d93c4c12

Download Submit
memory/4752-19-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4752-20-0x0000000002BF0000-0x0000000002CF9000-memory.dmp

Filesize
1.0MB

Download
memory/4752-31-0x0000000002B30000-0x0000000002B48000-memory.dmp

Filesize
96KB

Download
memory/4752-17-0x0000000000A00000-0x0000000000A27000-memory.dmp

Filesize
156KB

Download
memory/4752-12-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4752-14-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/4752-33-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4752-34-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4752-35-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4752-36-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4752-37-0x0000000002B50000-0x0000000002BA9000-memory.dmp

Filesize
356KB

Download
memory/4752-40-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download