2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e

Analysis

max time kernel
140s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
Size

1.2MB
MD5

06dc68c7bcb50d0eeefee9f1bfcaf40c
SHA1

3bb891fba9f37cfd50ed71a15ebb2bb17474f1de
SHA256

2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e
SHA512

2aaca80db351a8d29125c371d2965259c02482d29cf2cd49e69e6b4b789e33d028c74146bd3848bd97a68732e7edf7d9190396d9656fb6cb03d1b65c1b4058a9
SSDEEP

24576:BJ4SA4ax0NVhLAsiHrtMh4GkzPbThtja9oCm1:BFAELAfrKh4tPhtum1

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000900000001202f-4.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/files/0x000900000001202f-4.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ESPI11.dll	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
File created	C:\Windows\SysWOW64\ESPI11.dll	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
2296	2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe

C:\Users\Admin\AppData\Local\Temp\2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe
"C:\Users\Admin\AppData\Local\Temp\2d0fdab3680a5caa5d0cc128bde6b4081a0ff67ce532550acab65101084f969e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ESPI11.dll

Filesize
120KB

MD5
b4c2caaa15d4e505ad2858ab15eafb58

SHA1
a1c30a4d016f1c6bd3bf50e36767af8af166d59b

SHA256
93e03eadd330242f2394c15cd32857194e5b80f6300835ef77f8558ca70a2ef1

SHA512
09b5903a579685522a521cec3b6026ab0d7b9cff3099f032254dbd2b48fbbdd9a7411c0765049784c64f520d41916e681cae206a736b4fab1868f449e84b4bf2

Download Submit
\Users\Admin\AppData\Local\Temp\jedata.dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/2296-9-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/2296-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2296-13-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download