Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 13:02

General

  • Target

    $PLUGINSDIR/ProsperasoftwareAcPro.exe

  • Size

    866KB

  • MD5

    31abc2169a1a16bb337c396fe28fdd7e

  • SHA1

    27b5e845228440876687b3a5ecc929d60c5aa7cf

  • SHA256

    53dc1171e970e3acf956e746e8788eb67c0561e8c83fbb9dbbfb358de7c1014f

  • SHA512

    2b0f0b851412dbc0d289b0e4fca3356bec8e751a16b9096c175d11a1700c4c8702051d51d394284c302b81078b2b742f9ec618f891175f620324f92523f7c6fd

  • SSDEEP

    12288:1na9+q0FKLl/LdWSYWBH/9w05FTxTpITYRpECHGPC2uryEggVQ2l1/6tU4fi5rok:1naM/KR/LgYlFnxTS2pEmUqSYR6lUdVR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProsperasoftwareAcPro.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProsperasoftwareAcPro.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Users\Admin\AppData\Local\Temp\is-EBT33.tmp\ProsperasoftwareAcPro.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EBT33.tmp\ProsperasoftwareAcPro.tmp" /SL5="$30150,624057,53760,C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProsperasoftwareAcPro.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-EBT33.tmp\ProsperasoftwareAcPro.tmp

    Filesize

    687KB

    MD5

    dc2eac32c44ab039fc658875c2b5391b

    SHA1

    251571b7592a35d031f0e4c3e165a0a403e43015

    SHA256

    10851ae5da06ba556e8bc13caa591269473a09093e1d26119058eee725a80a46

    SHA512

    8b456a1b64ce9e107b7225b1d6297735231b248e64ea4f0a37b6d2a63bf4b5b1c9d41bc79b048521b50750d29127c6c762032244f737ac02a3a21a38f8a25b69

  • \Users\Admin\AppData\Local\Temp\is-KPFCN.tmp\IssProc.dll

    Filesize

    184KB

    MD5

    8eae382eabf41d58cb4e4f6bccb48bca

    SHA1

    104b402efcf67cfb885d3d5f2c3cbad9837c6fd2

    SHA256

    154cb086cf647d673cc0646ab3db30e2c68974743eb8348cd3d77113bd15d18b

    SHA512

    bc1d46e2b91b51c2adb84f6fa08cb5c0c95909fd7761e0a19a6db8e7f6a0e768d575530dd920e722ba5440cfcdee48677d3260bae473bced72a1a1c62ab0e469

  • \Users\Admin\AppData\Local\Temp\is-KPFCN.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/1776-8-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1776-20-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/1776-21-0x000000006B700000-0x000000006B72B000-memory.dmp

    Filesize

    172KB

  • memory/2452-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2452-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2452-19-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB